EventBridge domain event catalogue¶

Every domain event emitted by bank services onto Amazon EventBridge. Governed by ADR-029 (superseded by ADR-051 — see ADR-051 for current EventBridge bus naming convention) (domain event routing) and enforced by MOD-043 (EventBridge domain event governance).

Architecture constraints:

One bus per system domain. Bus names follow bank-<domain> (e.g. bank-core, bank-kyc).
Event name pattern: bank.<domain>.<noun>_<past-tense-verb>
All events carry a schema_version field. Consumers must validate this before processing.
Money amounts are always fixed-point decimal strings — never floats.
event_id and idempotency_key are always required. Consumers must deduplicate on idempotency_key.
All timestamps are ISO 8601 UTC.
Events document only fields that cross module boundaries. Internal state fields stay in the emitting service.

Related: ADR-029 (superseded by ADR-051 — see ADR-051 for current EventBridge bus naming convention) · Interface contracts · Data contracts

SD01 — Core Banking (`bank-core` bus)¶

`bank.core.posting_completed`¶

Emitted by MOD-001 on every successful double-entry posting committed to the ledger.

Field	Type	Required	Notes
event_id	uuid	✓	Unique event ID
event_time	ISO8601	✓	UTC
schema_version	string	✓	e.g. `"1.1.0"`
posting_id	uuid	✓	Stable posting reference
account_id	uuid	✓
amount	string	✓	Fixed-point decimal e.g. `"123.45"` — never float
currency	string	✓	ISO 4217
direction	string	✓	`DEBIT` or `CREDIT`
posting_type	string	✓	`PAYMENT` / `ACCRUAL` / `FX_CONVERSION` / `ADJUSTMENT` / `REVERSAL` / `PROVISION`
ledger_balance_after	string	✓	Fixed-point decimal
available_balance_after	string	✓	Fixed-point decimal
idempotency_key	string	✓	Caller-supplied; deduplication key
counterparty_account_id	uuid	✗	Present for internal transfers
jurisdiction	string	✓	`NZ` or `AU` — matches the credit-leg account's registered jurisdiction per FR-424
payment_id	uuid	✗	Present when the posting originates from SD04 payments; set by rail-integration callers (MOD-119/120/122/124/135/136/141 etc.) — absent for non-payment postings (ACCRUAL, ADJUSTMENT, PROVISION)

Consumers: MOD-022 (payment audit trail), MOD-002 (immutable transaction log), MOD-042 (CDC → Snowflake Iceberg), MOD-043 (EventBridge governance), MOD-087 (transaction enrichment — PAYMENT type only)

`bank.core.balance_updated`¶

Emitted by MOD-003 whenever a customer or nostro account balance changes, after the posting is committed. Enables downstream cache invalidation without polling, and provides the full before/after balance context needed by overdraft alert and collections consumers.

Schema version 1.1.0 — additive extension of v1.0.0. Existing consumers remain valid; new fields (previous_*, trace_id, correlation_id, jurisdiction, effective_at) are optional reads for v1.0.0 consumers.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.1.0"`
trace_id	uuid	✓	Added v1.1.0 — end-to-end trace from originating request
correlation_id	uuid	✗	Added v1.1.0 — links to originating payment or batch run
account_id	uuid	✓
currency	string	✓	ISO 4217
jurisdiction	string	✓	Added v1.1.0 — `NZ` or `AU`
previous_ledger_balance	string	✓	Added v1.1.0 — fixed-point decimal before this posting
ledger_balance	string	✓	Fixed-point decimal after this posting
previous_available_balance	string	✓	Added v1.1.0 — fixed-point decimal before this posting
available_balance	string	✓	Fixed-point decimal after this posting
posting_id	uuid	✓	Causal posting reference; doubles as the idempotency sequence
effective_at	ISO8601	✓	Added v1.1.0 — timestamp of the causal posting (`postings.created_at`)
idempotency_key	string	✓	`mod003:balance:{posting_id}`

Emission cadence: one event per bank.core.posting_completed that affects a deposit account. MOD-003 consumes posting_completed and re-emits balance_updated with the before/after snapshot. No producer-side filtering — all deposit account balance changes are emitted unconditionally; consumers apply EventBridge detail-pattern filters.

Consumers: MOD-070 (transaction history & search), MOD-077 (account dashboard), MOD-032 (LCR/NSFR calculator), MOD-042 (CDC → Snowflake), MOD-117 (overdraft — CON-008 unarranged facility alert uses previous_available_balance + available_balance to detect the moment a balance crosses into overdraft territory)

`bank.core.account_status_changed`¶

Emitted by MOD-007 when an account transitions between states (PENDING → ACTIVE → RESTRICTED → DORMANT → CLOSED).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
account_id	uuid	✓
party_id	uuid	✓	Canonical cross-domain party reference
previous_status	string	✓	`PENDING` / `ACTIVE` / `RESTRICTED` / `DORMANT` / `CLOSED`
new_status	string	✓
restriction_reason	string		Populated when new_status = `RESTRICTED`: `SANCTIONS` / `FRAUD_INVESTIGATION` / `HARDSHIP_ARRANGEMENT` / `ADMIN`
reason_code	string	✓	Stable machine key e.g. `SANCTIONS_HOLD`, `KYC_VERIFIED`, `DORMANCY_NZ`, `MANUAL_CLOSE`
triggered_by	string	✓	`SYSTEM` / `AGENT` / `CUSTOMER`
triggering_event_id	uuid		Upstream event ID when transition was EB-driven (e.g. `identity_verified` event ID for KYC gate)
idempotency_key	string	✓

Consumers: MOD-020 (pre-payment validation — gates payments on Restricted/Closed), MOD-013 (sanctions screener), MOD-039 (customer risk score), MOD-043 (governance), MOD-074 (back-office customer 360)

`bank.core.interest_accrued`¶

Emitted by MOD-005 after each daily accrual run completes for an account.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
account_id	uuid	✓
accrual_date	string	✓	`YYYY-MM-DD`
accrual_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
rate_applied	string	✓	Percentage as decimal string e.g. `"5.25"`
posting_id	uuid	✓	Ledger posting reference
idempotency_key	string	✓	`accrual-<account_id>-<accrual_date>`

Consumers: MOD-002 (immutable log), MOD-042 (CDC → Snowflake), MOD-035 (IRRBB/NII model)

`bank.core.accrual_run_completed`¶

Emitted by MOD-005 once per accrual run after completeRun writes totals. Carries the full run summary so downstream analytics and monitoring modules do not need to query core.accrual_runs directly.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
run_id	uuid	✓	FK to `core.accrual_runs`
jurisdiction	string	✓	`NZ` / `AU`
accrual_date	string	✓	`YYYY-MM-DD`
run_type	string	✓	`DAILY` / `CORRECTION`
status	string	✓	`COMPLETED` / `FAILED`
accounts_processed	int	✓
accounts_posted	int	✓
accounts_skipped	int	✓
accounts_errored	int	✓
interest_credited	string	✓	Fixed-point decimal — total savings interest credited
interest_charged	string	✓	Fixed-point decimal — total overdraft interest charged
by_product	object	✓	Per product_code breakdown `{count, amount}`
variance_flags	array	✓	Accounts with amount deviation (empty array when none)
idempotency_key	string	✓	Matches `core.accrual_runs.idempotency_key`

Consumers: MOD-002 (transaction log), MOD-042 (CDC → Snowflake), MOD-031 (rate sensitivity / NII model), MOD-076 (operational dashboards)

`bank.core.accrual_correction_posted`¶

Emitted by MOD-005 after a retroactive correction run completes (FR-064). Carries references to both the original accrual posting and the correction so audit and compliance modules can reconstruct the full correction chain without joining tables.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
run_id	uuid	✓	FK to the CORRECTION `core.accrual_runs` row
correction_of_run_id	uuid	✓	FK to the original DAILY run
account_id	uuid	✓
accrual_date	string	✓	`YYYY-MM-DD` — date of the original accrual being corrected
original_accrual_posting_id	uuid	✓	The `core.accrual_postings` row being corrected
corrected_accrual_posting_id	uuid	✓	The new CORRECTED `core.accrual_postings` row
original_amount	string	✓	Fixed-point signed decimal — amount from the original run
corrected_amount	string	✓	Fixed-point signed decimal — amount after correction
correction_reason	string	✓	Free text — supplied by authorising staff
authorised_by	string	✓	Role or identity that authorised the correction
idempotency_key	string	✓	Matches correction run's `idempotency_key`

Consumers: MOD-002 (transaction log), MOD-042 (CDC → Snowflake), MOD-047 (audit trail), compliance reporting

`bank.core.rate_change_proposed`¶

Emitted by MOD-006 when a rate change proposal is submitted for maker/checker review.

Bus: bank-core · Source: bank.core · Detail-type: rate_change_proposed

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓
proposal_id	string	✓	UUID — FK to `core.rate_change_proposals`
product_code	string	✓
rate_type	string	✓	`BASE` / `BONUS` / `PENALTY` / `OVERDRAFT` / `FIXED_LENDING` / `VARIABLE_LENDING`
new_annual_rate	string	✓	Decimal string
previous_annual_rate	string	✗	Null on first-ever rate for this product+type
change_kind	string	✓	`INCREASE` / `DECREASE`
effective_from	string	✓	`YYYY-MM-DD`
is_retroactive	boolean	✓
customer_notice_required	boolean	✓	True for retail variable-rate increases (FR-516)
proposed_by	string	✓	Cross-domain staff UUID
trace_id	string	✓
correlation_id	string	✓

Consumers: (audit dashboards)

`bank.core.rate_change_approved`¶

Emitted by MOD-006 when a second authorised user approves a rate change proposal.

Bus: bank-core · Source: bank.core · Detail-type: rate_change_approved

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓
proposal_id	string	✓	UUID
product_code	string	✓
rate_type	string	✓
new_annual_rate	string	✓	Decimal string
change_kind	string	✓	`INCREASE` / `DECREASE`
effective_from	string	✓	`YYYY-MM-DD`
reviewed_by	string	✓	Cross-domain staff UUID (must differ from proposed_by)
customer_notice_required	boolean	✓
trace_id	string	✓
correlation_id	string	✓

Consumers: (audit dashboards)

`bank.core.rate_change_rejected`¶

Emitted by MOD-006 when a reviewer rejects a rate change proposal.

Bus: bank-core · Source: bank.core · Detail-type: rate_change_rejected

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓
proposal_id	string	✓	UUID
product_code	string	✓
rate_type	string	✓
reviewed_by	string	✓	Cross-domain staff UUID
review_comment	string	✓
trace_id	string	✓
correlation_id	string	✓

Consumers: (audit dashboards)

`bank.core.rate_change_notified`¶

Emitted by MOD-006 at approval time when a rate increase on a retail variable-rate product requires the 14-day advance-notice period (FR-516). The notice period starts ticking from event_time.

Bus: bank-core · Source: bank.core · Detail-type: rate_change_notified

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓
proposal_id	string	✓	UUID
product_code	string	✓
rate_type	string	✓
product_type	string	✓	e.g. `SAVINGS` / `VARIABLE_HOME_LOAN`
jurisdiction	string	✓	`NZ` / `AU` / `NZ + AU`
new_annual_rate	string	✓	Decimal string
previous_annual_rate	string	✗
effective_from	string	✓	`YYYY-MM-DD`
notice_period_days	number	✓	Minimum 14 for NZ + AU retail (FR-516)
trace_id	string	✓
correlation_id	string	✓

Consumers: MOD-063 (notification orchestration — dispatches 14-day advance-notice to affected customers)

`bank.core.rate_change_activated`¶

Emitted by MOD-006 within 30 seconds of a rate becoming active (FR-068). Carries complete payload for downstream consumers.

Bus: bank-core · Source: bank.core · Detail-type: rate_change_activated

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓
proposal_id	string	✓	UUID
rate_id	string	✓	UUID — new `accounts.interest_rates` row created on activation
product_code	string	✓
rate_type	string	✓
new_annual_rate	string	✓	Decimal string
previous_annual_rate	string	✗
change_kind	string	✓	`INCREASE` / `DECREASE`
effective_from	string	✓	`YYYY-MM-DD`
is_retroactive	boolean	✓	When true, MOD-005 triggers FR-064 retroactive correction
notification_required	boolean	✓	True when CON-004/CON-005 disclosure must be dispatched
authorised_by	string	✓	Cross-domain staff UUID of approving reviewer
trace_id	string	✓
correlation_id	string	✓

Consumers: MOD-005 (FR-062 rate read — must see new rate before next accrual run; triggers FR-064 correction if is_retroactive=true), MOD-031 (CLQ-004 IRRBB repricing gap derivation), MOD-042 (CDC)

`bank.core.dormancy_triggered`¶

Emitted by MOD-008 at each stage of the dormancy lifecycle: initial dormancy classification, pre-escheatment notice crossings (90/30/7 days), and escheatment completion. One event per stage transition per account.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
account_id	uuid	✓
party_id	uuid	✓	Canonical cross-domain party reference
dormancy_stage	string	✓	`DORMANT` / `ESCHEATMENT_PENDING` / `ESCHEATMENT_SUBMITTED`
inactive_since	string	✓	`YYYY-MM-DD` — date of last customer-initiated transaction
statutory_escheatment_date	string		`YYYY-MM-DD` — present for ESCHEATMENT_PENDING and ESCHEATMENT_SUBMITTED
days_until_escheatment	integer		Present when dormancy_stage = `ESCHEATMENT_PENDING`; 90, 30, or 7
balance	string	✓	Fixed-point decimal at time of event
currency	string	✓	ISO 4217
jurisdiction	string	✓	`NZ` / `AU`
regulator	string		`IRD` (NZ) or `ASIC` (AU) — present for ESCHEATMENT_PENDING and ESCHEATMENT_SUBMITTED
idempotency_key	string	✓

Consumers: MOD-007 (account state machine — transitions to Dormant), MOD-063 (notification orchestration — routes 90/30/7-day notice to customer), MOD-057 (statistical returns — unclaimed money reporting)

`bank.core.fx_rate_received`¶

Published by the Snowflake marketplace rate-feed provider (upstream of MOD-004) when a fresh mid-market FX rate is available. MOD-004's Mod004FxRateIngest Lambda consumes this to insert a row into accounts.fx_rates and trigger revaluation if configured. In non-prod, MOD-004's Mod004DevRateSeeder Lambda fires this event on a rate(30 minutes) cron.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
source_currency	string	✓	ISO 4217
target_currency	string	✓	ISO 4217
mid_rate	string	✓	Decimal string — target per 1 source unit
spread_pct	string	✓	Decimal string
provider_id	string	✓	Rate provider identifier
rate_timestamp	ISO8601	✓	Point-in-time the rate was valid
idempotency_key	string	✓

Consumers: MOD-004 (multi-currency ledger — inserts into accounts.fx_rates, triggers EOD revaluation)

`bank.core.fx_conversion_completed`¶

Emitted by MOD-004 after a committed 4-leg multi-currency conversion (FR-434). MOD-002's EventBridge ingest rule subscribes to this event alongside posting_completed and interest_accrued.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
conversion_id	uuid	✓	FK to `accounts.fx_conversions.id`
party_id	uuid	✓
source_account_id	uuid	✓
target_account_id	uuid	✓
source_amount	string	✓	Fixed-point decimal
target_amount	string	✓	Fixed-point decimal
source_currency	string	✓	ISO 4217
target_currency	string	✓	ISO 4217
applied_rate	string	✓	Decimal string
cross_border	boolean	✓	AML-008 AUTO — set when currency or jurisdiction crosses
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log — ingests via widened event-rules pattern)

`bank.core.fx_revaluation_completed`¶

Emitted by MOD-004 after each EOD revaluation run that produced a non-zero P&L delta (FR-435). Used by downstream analytics and audit consumers.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
jurisdiction	string	✓	`NZ` / `AU`
rate_timestamp	ISO8601	✓	Rate used for this revaluation run
pnl_delta	string	✓	Fixed-point decimal — gain/loss for this run
cumulative_pnl	string	✓	Running total after this run
revaluation_posting_id	uuid	✓	The P&L posting row in `accounts.postings`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), internal finance reporting

`bank.core.fee_assessed`¶

Emitted by MOD-110 whenever a fee is evaluated for an account — both when it will be posted and when it is waived. Enables downstream audit reconstruction without replaying fee engine logic.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
fee_event_id	uuid	✓	FK to `core.fee_events.event_id`
account_id	uuid	✓
party_id	uuid	✓
fee_type	string	✓	e.g. `MONTHLY_FEE` / `TRANSACTION_FEE` / `DISHONOUR_FEE`
assessed_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
waived	boolean	✓	True when no posting will follow
waiver_reason	string	✗	Present when waived=true — name of the applied waiver condition
waiver_check	object	✓	`{"evaluated": ["zero_balance","promo"], "applied": "zero_balance" \\| null}`
schedule_version	integer	✓	Fee schedule version active at assessment time
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓	Caller-supplied; matches the fee posting idempotency key

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC → Snowflake), MOD-043 (EventBridge governance)

`bank.core.fee_posted`¶

Emitted by MOD-110 after a fee has been successfully committed to the ledger via MOD-001. Enables real-time fee revenue reporting and downstream audit reconciliation.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
fee_event_id	uuid	✓	FK to `core.fee_events.event_id` — correlates to `fee_assessed`
account_id	uuid	✓
party_id	uuid	✓
fee_type	string	✓
amount	string	✓	Fixed-point decimal — posted amount
currency	string	✓	ISO 4217
posting_id	uuid	✓	FK to `accounts.postings.id` — debit leg
income_account	string	✓	GL income account credited — `MOD-110-FEE-INCOME-NZ` or `MOD-110-FEE-INCOME-AU`
schedule_version	integer	✓
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC → Snowflake), MOD-043 (EventBridge governance)

`bank.core.fee_reversed`¶

Emitted by MOD-110 after a fee reversal is committed to the ledger. The reversing posting is a compensating credit to the customer account and a debit to the fee income account. In v1 no approval tier is validated — reversals are record-only, authorised by staff via MOD-083; tier gating is deferred to MOD-109.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
reversal_event_id	uuid	✓	New `core.fee_events` row for this reversal
original_fee_event_id	uuid	✓	The `fee_assessed` / `fee_posted` event being reversed
original_posting_id	uuid	✓	Original debit leg posting
reversal_posting_id	uuid	✓	New credit leg posting
account_id	uuid	✓
party_id	uuid	✓
fee_type	string	✓
amount	string	✓	Fixed-point decimal — reversed amount (positive)
currency	string	✓	ISO 4217
reversal_reason	string	✓	Free text — required by CON-004
authorised_by	string	✓	`staff_id` of the agent who initiated the reversal
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC → Snowflake), MOD-043 (EventBridge governance)

`bank.core.fee_waived`¶

Emitted by MOD-110 when a previously posted fee is waived as a deliberate policy decision — hardship accommodation, goodwill gesture, or regulatory remedy. Distinct from fee_reversed (which corrects an erroneously posted fee) and from the waived flag on fee_assessed (which signals an automated pre-posting waiver condition). CON-004 and CON-008 audit surface.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
waiver_event_id	uuid	✓	New `core.fee_events` row for this waiver
original_fee_event_id	uuid	✓	The `fee_posted` event being waived
original_posting_id	uuid	✓	Original debit leg posting
credit_posting_id	uuid	✓	Compensating credit leg posting
account_id	uuid	✓
party_id	uuid	✓
fee_type	string	✓
amount	string	✓	Fixed-point decimal — waived amount (positive)
currency	string	✓	ISO 4217
waiver_reason	string	✓	Structured reason code: `HARDSHIP_ARRANGEMENT` / `GOODWILL` / `REGULATORY_REMEDY` / `RELATIONSHIP_RETENTION`
waiver_notes	string	✗	Optional free-text supporting note
authorised_by	string	✓	`staff_id` of the approving officer (checker leg)
proposed_by	string	✓	`staff_id` of the proposing officer (maker leg)
checker_proposal_id	uuid	✗	MOD-168 proposal reference; present once MOD-168 is deployed
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC → Snowflake), MOD-043 (EventBridge governance), MOD-063 (notification orchestration — customer confirmation of waiver)

Future event: bank.core.fee_schedule_published — will be emitted by MOD-006 when the product catalogue admin API ships. MOD-110 will subscribe to apply updated fee schedules. Not yet catalogued as MOD-006 has no event contract; v1 loads schedules via direct SQL seed only.

`bank.core.trust_account_activated`¶

Emitted by MOD-133 after the activate Lambda successfully calls applyTransitionInClient with reason_code = "TRUST_GATE_PASS" and the account transitions PENDING → ACTIVE.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
trust_account_id	uuid	✓	`core.trust_accounts.trust_account_id`
account_id	uuid	✓	`accounts.accounts.id`
trust_type	string	✓	`family_discretionary` / `testamentary` / `charitable` / `commercial_unit`
jurisdiction	string	✓	`NZ` / `AU`
activated_at	ISO8601	✓
trace_id	string
correlation_id	string

Consumers: MOD-042 (CDC → Snowflake), MOD-043 (EventBridge governance), MOD-047 (staff.action_taken audit trail)

`bank.core.trustee_changed`¶

Emitted by MOD-133 when a trustee is added or removed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
trust_account_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓	Trustee's party_id
change	string	✓	`ADDED` / `REMOVED`
trace_id	string
correlation_id	string

Consumers: MOD-034 (risk elevation trigger — CDD review), MOD-042 (Snowflake CDC), MOD-047 (audit)

`bank.core.beneficial_owner_changed`¶

Emitted by MOD-133 when a beneficial owner is added, changed, or removed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
trust_account_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓	Beneficial owner's party_id
change	string	✓	`ADDED` / `CHANGED` / `REMOVED`
ownership_pct	number		Trust ownership percentage; nullable for discretionary BOs
trace_id	string
correlation_id	string

Consumers: MOD-034 (risk elevation trigger — CDD review), MOD-042 (Snowflake CDC), MOD-047 (audit)

`bank.core.cdd_review_required`¶

Emitted by MOD-133 when a CDD review is triggered for a trust account (30-day SLA, FR-595).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
trust_account_id	uuid	✓
account_id	uuid	✓
review_trigger	string	✓	`TRUSTEE_CHANGE` / `BENEFICIARY_CHANGE` / `RISK_ELEVATION` / `PERIODIC`
due_at	ISO8601	✓	triggered_at + 30 days
governance_event_id	uuid	✓	`core.trust_governance_events.event_id` of the CDD_REVIEW_TRIGGERED row
trace_id	string
correlation_id	string

Consumers: MOD-047 (staff.action_taken audit), MOD-043 (EventBridge governance)

`bank.core.cdd_review_completed`¶

Emitted by MOD-133 when a CDD review is marked complete.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
trust_account_id	uuid	✓
account_id	uuid	✓
triggered_event_id	uuid	✓	Links back to the CDD_REVIEW_TRIGGERED governance event
next_review_date	string		ISO date; nullable
trace_id	string
correlation_id	string

Consumers: MOD-047 (staff.action_taken audit), MOD-043 (EventBridge governance)

`bank.core.community_account_activated`¶

Emitted by MOD-134 after the activate Lambda successfully calls applyTransitionInClient with reason_code = "COMMUNITY_GATE_PASS" and the account transitions PENDING → ACTIVE.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
community_account_id	uuid	✓	`core.community_accounts.community_account_id`
account_id	uuid	✓
entity_type	string	✓	e.g. `sports_club`, `incorporated_society`
signing_rule	string	✓	`any_one` / `any_two` / `all`
jurisdiction	string	✓	`NZ` / `AU`
activated_at	ISO8601	✓
trace_id	string
correlation_id	string

Consumers: MOD-002 (transaction log), MOD-042 (CDC → Snowflake), MOD-047 (audit)

`bank.core.community_signatory_changed`¶

Emitted by MOD-134 when a signatory is added, removed, or updated during annual committee refresh.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
community_account_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓	Affected signatory's party_id
change	string	✓	`ADDED` / `REMOVED` / `REFRESHED`
committee_role	string	✓	`president` / `treasurer` / `secretary` / `authorised_signatory`
trace_id	string
correlation_id	string

Consumers: MOD-042 (Snowflake CDC), MOD-047 (audit)

`bank.core.community_signing_rule_changed`¶

Emitted by MOD-134 when the signing rule is updated for a community account.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
community_account_id	uuid	✓
account_id	uuid	✓
previous_signing_rule	string	✓
new_signing_rule	string	✓	`any_one` / `any_two` / `all`
trace_id	string
correlation_id	string

Consumers: MOD-042 (Snowflake CDC), MOD-047 (audit)

`bank.core.community_authorisation_completed`¶

Emitted by MOD-134 when a community account authorisation accumulates the required number of signatory approvals (FR-598). The authorisation_id is the reference callers present when initiating a payment debit against a community account.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
community_account_id	uuid	✓
account_id	uuid	✓
authorisation_id	uuid	✓	`core.community_authorisations.authorisation_id`
signing_rule	string	✓	Rule that was satisfied
approver_count	integer	✓	Number of distinct approvers
completed_at	ISO8601	✓
trace_id	string
correlation_id	string

Consumers: Future SD04 payment caller (must verify a COMPLETE authorisation before debiting a community account — named debt per ADR per orchestrator Q2)

`bank.core.community_account_restricted_insufficient_signatories`¶

Emitted by MOD-134 when active verified signatory count drops below the signing-rule minimum and the account is transitioned to RESTRICTED (FR-600).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
community_account_id	uuid	✓
account_id	uuid	✓
signing_rule	string	✓	The rule that can no longer be met
active_verified_count	integer	✓	Count of currently VERIFIED signatories
required_count	integer	✓	Minimum required by the signing rule
trace_id	string
correlation_id	string

Consumers: MOD-063 (notify account holder and signatories — routes once deployed), MOD-002 (transaction log), MOD-042 (Snowflake CDC)

`bank.core.joint_account_activated`¶

Emitted by MOD-125 when all activation gate conditions pass (≥ 2 active verified holders, all consented, ownership shares sum to 100) and the account is transitioned from PENDING to ACTIVE.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
joint_account_id	uuid	✓	`core.joint_accounts.joint_account_id`
account_id	uuid	✓
holder_count	integer	✓	Number of active holders at activation
jurisdiction	string	✓	`"NZ"` or `"AU"`
trace_id	string
correlation_id	string

Consumers: MOD-002 (transaction log), MOD-042 (Snowflake CDC)

`bank.core.joint_holder_changed`¶

Emitted by MOD-125 when a holder is added (action='ADDED'), removed (action='REMOVED'), or a death is recorded (action='DECEASED').

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
joint_account_id	uuid	✓
account_id	uuid	✓
action	string	✓	`"ADDED"`, `"REMOVED"`, or `"DECEASED"`
holder_relationship_id	uuid	✓	The changed holder's relationship ID
trace_id	string
correlation_id	string

Consumers: MOD-002, MOD-042, MOD-063 (notify surviving holders)

`bank.core.joint_signing_authority_changed`¶

Emitted by MOD-125 when the account's signing_authority field is updated.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
joint_account_id	uuid	✓
account_id	uuid	✓
previous_signing_authority	string	✓
new_signing_authority	string	✓
trace_id	string
correlation_id	string

Consumers: MOD-002, MOD-042

`bank.core.joint_share_adjusted`¶

Emitted by MOD-125 when ownership share percentages are updated. Reserved for future server-driven re-allocation flows.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
joint_account_id	uuid	✓
account_id	uuid	✓
share_snapshot	array	✓	`[{holder_relationship_id, ownership_share_pct}]`
trace_id	string
correlation_id	string

Consumers: MOD-042

`bank.core.joint_authorisation_completed`¶

Emitted by MOD-125 when all required holder approvals are collected and an authorisation reaches status='COMPLETE'.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
joint_account_id	uuid	✓
account_id	uuid	✓
authorisation_id	uuid	✓	`core.joint_authorisations.authorisation_id`
action_type	string	✓	`"PAYMENT"`, `"ADD_HOLDER"`, `"REMOVE_HOLDER"`, or `"CHANGE_SIGNING"`
trace_id	string
correlation_id	string

Consumers: Future SD04 payment caller (consume to proceed with debit once SD04 ships)

`bank.core.joint_holder_death_recorded`¶

Emitted by MOD-125 when recordDeath is called and a holder's status is flipped to 'deceased'. The account is frozen (death_documentation_status = 'frozen') until acceptDeathDocumentation is called.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
tenant_id	string	✓	`"totara-bank"`
joint_account_id	uuid	✓
account_id	uuid	✓
holder_relationship_id	uuid	✓	The deceased holder's relationship ID
deceased_at	ISO8601	✓
trace_id	string
correlation_id	string

Consumers: MOD-063 (notify surviving holders), MOD-002, MOD-042

`bank.core.term_deposit_opened`¶

Emitted by MOD-111 when a new term deposit is created.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
account_id	uuid	✓
amount	string	✓	Decimal string
currency	string	✓	ISO 4217
term_months	integer	✓
annual_interest_rate	string	✓	Decimal string
maturity_date	string	✓	`YYYY-MM-DD`
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓
trace_id	string	✗

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC)

`bank.core.term_deposit_pre_maturity_notice`¶

Emitted by MOD-111 pre-maturity-notices Lambda at 30, 14, and 7 days before maturity (FR-494).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓	Customer reference
maturity_date	string	✓	`YYYY-MM-DD`
days_until_maturity	integer	✓	30 / 14 / 7
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — dispatches pre-maturity notice to customer per FR-494)

`bank.core.term_deposit_instruction_captured`¶

Emitted by MOD-111 when a maturity instruction (ROLLOVER or WITHDRAW) is recorded.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
instruction_type	string	✓	`ROLLOVER` / `WITHDRAW`
source	string	✓	`CUSTOMER` / `AUTO_DEFAULT`
idempotency_key	string	✓
trace_id	string	✗

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC)

`bank.core.term_deposit_break_cost_disclosed`¶

Emitted by MOD-111 when a break-cost disclosure is generated for an early-withdrawal request.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
disclosure_id	uuid	✓
break_cost_amount	string	✓	Decimal string
currency	string	✓	ISO 4217
remaining_term_days	integer	✓
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log)

`bank.core.term_deposit_break_cost_accepted`¶

Emitted by MOD-111 when the customer accepts the break-cost disclosure.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
disclosure_id	uuid	✓
accepted_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log)

`bank.core.term_deposit_rolled_over`¶

Emitted by MOD-111 apply-maturity Lambda when a deposit is rolled over into a new term.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
previous_deposit_id	uuid	✓	Closed (ROLLED) deposit
new_deposit_id	uuid	✓	New deposit created by rollover
account_id	uuid	✓
principal	string	✓	Decimal string — rolled principal
accrued_interest	string	✓	Decimal string — interest credited
new_maturity_date	string	✓	`YYYY-MM-DD`
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC)

`bank.core.term_deposit_proceeds_disbursed`¶

Emitted by MOD-111 apply-maturity Lambda when a deposit matures and proceeds are credited to the nominated account (PAY-001 AUTO path).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
account_id	uuid	✓	Source account
nominated_account_id	uuid	✓	Destination account
principal	string	✓	Decimal string
accrued_interest	string	✓	Decimal string
final_proceeds	string	✓	Decimal string
currency	string	✓	ISO 4217
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC)

`bank.core.term_deposit_broken_early`¶

Emitted by MOD-111 when an early withdrawal is processed after break-cost acceptance.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
deposit_id	uuid	✓
disclosure_id	uuid	✓	Accepted break-cost disclosure
account_id	uuid	✓
principal	string	✓	Decimal string
break_cost_amount	string	✓	Decimal string — deducted from proceeds
net_proceeds	string	✓	Decimal string — principal minus break cost
currency	string	✓	ISO 4217
broken_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC)

`bank.core.notice_lodged`¶

Emitted by MOD-130 when a customer successfully lodges a notice of withdrawal.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
lodgement_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓
amount	string	✓	Decimal string — full balance if partial not specified
currency	string	✓	ISO 4217
notice_period_days	integer	✓
withdrawal_date	string	✓	`YYYY-MM-DD` — today + notice_period_days
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — lodgement confirmation per CON-004)

`bank.core.notice_pre_withdrawal_reminder`¶

Emitted by MOD-130 daily cron when withdrawal_date = today + 7 (FR-551).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
lodgement_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓
withdrawal_date	string	✓	`YYYY-MM-DD`
amount	string	✓	Decimal string
currency	string	✓	ISO 4217
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — 7-day reminder per CON-004)

`bank.core.notice_funds_available`¶

Emitted by MOD-130 daily cron after auto-release posting succeeds on maturity day (FR-551).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
lodgement_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓
amount	string	✓	Decimal string — withdrawn amount
currency	string	✓	ISO 4217
withdrawal_date	string	✓	`YYYY-MM-DD`
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — funds available per CON-004 / FR-551)

`bank.core.notice_early_withdrawal_disclosed`¶

Emitted by MOD-130 when an early-withdrawal penalty disclosure is generated.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
disclosure_id	uuid	✓
lodgement_id	uuid	✓
account_id	uuid	✓
penalty_amount	string	✓	Decimal string
withdrawal_amount	string	✓	Decimal string
currency	string	✓	ISO 4217
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log)

`bank.core.notice_early_withdrawal_accepted`¶

Emitted by MOD-130 after customer accepts the penalty disclosure and the withdrawal + penalty postings commit (CON-005 evidence).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
disclosure_id	uuid	✓	Accepted disclosure
lodgement_id	uuid	✓
account_id	uuid	✓
party_id	uuid	✓
penalty_amount	string	✓	Decimal string
net_proceeds	string	✓	Decimal string — withdrawal minus penalty
currency	string	✓	ISO 4217
accepted_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-042 (CDC)

`bank.core.notice_liquidity_snapshot`¶

Emitted by MOD-130 daily cron — notice account balances bucketed by withdrawal date horizon for LCR/NSFR (FR-552 / CLQ-002 CALC).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
snapshot_date	string	✓	`YYYY-MM-DD` — date of calculation
jurisdiction	string	✓	`NZ` / `AU`
within_30_days	string	✓	Decimal string — aggregate balance with withdrawal_date ≤ today+30
days_31_to_60	string	✓	Decimal string
days_61_to_90	string	✓	Decimal string
currency	string	✓	ISO 4217
lodgement_count	integer	✓	Number of active pending lodgements included
idempotency_key	string	✓

Consumers: MOD-032 (LCR/NSFR calculator — notice account stable funding contribution per CLQ-002)

`bank.core.obr_activated`¶

Emitted by MOD-143 at the moment the OBR partition transaction commits. Triggers customer-notification dispatch via MOD-063 and provides the primary audit anchor for the resolution event under the RBNZ DTA OBR Pre-positioning Standard.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓	SHA256 of `partition_event_id`
rbnz_instruction_ref	string	✓	RBNZ-supplied instruction reference number
haircut_pct	string	✓	Decimal string — e.g. `"0.2000"` for 20% haircut
accounts_partitioned_count	integer	✓	Number of deposit accounts stamped
total_frozen_amount	string	✓	Decimal string — aggregate `obr_frozen_amount` across all affected accounts
total_available_amount	string	✓	Decimal string — aggregate `obr_available_amount` across all affected accounts
activated_at	ISO8601	✓	Timestamp of partition commit
activated_by	string	✓	Cognito staff-identity UUID of the resolution officer (v1: record-only; cryptographic verification is follow-up)
jurisdiction	string	✓	`NZ` — OBR is an RBNZ instrument; AU equivalent is APRA-governed separately

Consumers: MOD-063 (customer notification — single summary comms-plan dispatch; per-depositor fan-out is a named follow-up)

`bank.core.obr_resolved`¶

Emitted by MOD-143 at the moment the resolution-unwind transaction commits. Signals that resolution_state has returned to normal, frozen amounts have been unwound, and confirmed credit-loss write-offs have been posted via MOD-001.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
rbnz_instruction_ref	string	✓	Matches the original activation instruction ref
total_writeoff_amount	string	✓	Decimal string — sum of credit-loss postings applied
accounts_unwound_count	integer	✓
resolved_at	ISO8601	✓
resolved_by	string	✓	Cognito staff-identity UUID

Consumers: MOD-063 (resolution-end customer notification — named follow-up)

`bank.core.obr_state_verified`¶

Emitted by MOD-143 on each authenticated call to the RBNZ-facing get-resolution-state endpoint. Provides an immutable audit trail of every RBNZ inquiry, satisfying FR-633's "all transitions audited" obligation.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
resolution_state	string	✓	`normal` \| `pre_positioned` \| `activated`
queried_by	string	✓	Cognito staff-identity UUID of the querying officer
rbnz_instruction_ref	string	✗	Present only when `resolution_state = activated`

Consumers: audit / RBNZ reporting dashboards

`bank.core.amortisation_schedule_generated`¶

Emitted by MOD-112 at loan origination when the initial amortisation schedule is produced. Triggers customer delivery of the repayment schedule (CON-004 / CRE-002). Must be delivered to the customer via MOD-063 + MOD-113 within 60 seconds of loan settlement (FR-498).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
account_id	uuid	✓
schedule_id	uuid	✓	References `loans.amortisation_schedules`
schedule_type	string	✓	`PI` \| `IO` \| `REVOLVING`
total_instalments	integer	✓
total_interest_payable	string	✓	Fixed-point decimal
effective_annual_rate	string	✓	Fixed-point decimal
first_payment_due	string	✓	ISO 8601 date

Consumers: MOD-063 (notification orchestration — schedule delivery to customer), MOD-113 (document vault — schedule document generation)

`bank.core.amortisation_schedule_recalculated`¶

Emitted by MOD-112 after any schedule-changing event (variable-rate change, extra repayment acceptance, interest-only expiry, hardship restructure). New schedule version committed before event is emitted (CON-004). Customer delivery within 24h required (FR-499).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
account_id	uuid	✓
new_schedule_id	uuid	✓
prior_schedule_id	uuid	✓
trigger	string	✓	`RATE_CHANGE` \| `EXTRA_REPAYMENT` \| `IO_EXPIRY` \| `HARDSHIP_RESTRUCTURE`
new_total_interest_payable	string	✓	Fixed-point decimal
new_effective_annual_rate	string	✓	Fixed-point decimal

Consumers: MOD-063 (notification — updated schedule delivery), MOD-113 (document vault — revised schedule document)

`bank.core.amortisation_extra_repayment_options`¶

Emitted by MOD-112 when a customer submits an extra repayment and previews their restructure options. Contains both options before the customer accepts (FR-500 step 1 of 2).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
account_id	uuid	✓
extra_repayment_amount	string	✓	Fixed-point decimal
reduce_term_option_id	uuid	✓	Preview schedule ID for option (a)
reduce_instalment_option_id	uuid	✓	Preview schedule ID for option (b)

Consumers: MOD-068 (customer app — displays option choice to customer)

`bank.core.revolving_minimum_repayment_posted`¶

Emitted by MOD-112 daily cron when the revolving credit minimum repayment is automatically posted for a PRD-008 account (FR-501). One event per account per cycle.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
account_id	uuid	✓
minimum_repayment	string	✓	Fixed-point decimal — max(floor, balance × pct)
posting_id	uuid	✓	References `accounts.postings`
balance_at_posting	string	✓	Fixed-point decimal

Consumers: MOD-063 (notification — repayment reminder / confirmation)

`bank.core.revolving_late_payment_assessed`¶

Emitted by MOD-112 when a revolving credit payment is received but falls below the minimum repayment threshold (FR-501). Triggers MOD-110 fee assessment.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
idempotency_key	string	✓
account_id	uuid	✓
minimum_repayment	string	✓	Fixed-point decimal — the floor that was not met
amount_received	string	✓	Fixed-point decimal — what the customer paid
shortfall	string	✓	Fixed-point decimal

Consumers: MOD-110 (fee engine — late payment fee assessment)

`bank.core.share_transaction_completed`¶

Emitted by MOD-118 after each share capital movement (purchase, redemption, transfer, dividend reinvestment, or correction) settles or is blocked by the CLQ-001 capital gate. Mutual-institution tenants only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
tx_id	uuid	✓	FK to `core.share_transactions`
member_id	uuid	✓
party_id	uuid	✓
tx_type	string	✓	`PURCHASE` \| `REDEMPTION` \| `TRANSFER_IN` \| `TRANSFER_OUT` \| `DIVIDEND_REINVESTMENT` \| `CORRECTION`
shares	string	✓	Fixed-point decimal; negative for deductions
total_amount	string	✓	Fixed-point decimal
status	string	✓	`SETTLED` \| `BLOCKED`
blocked_reason	string	✗	`capital_gate` when CLQ-001 fires
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-063 (member notification on SETTLED or BLOCKED status).

`bank.core.dividend_declared`¶

Emitted by MOD-118 when a board dividend declaration is created with status = 'DECLARED'. Mutual-institution tenants only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
declaration_id	uuid	✓
record_date	string	✓	ISO 8601 date
payment_date	string	✓	ISO 8601 date
rate_per_share	string	✓	Fixed-point decimal
total_declared	string	✓	Fixed-point decimal
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-063 (back-office acknowledgement of declaration), MOD-022 (audit trail).

`bank.core.dividend_paid`¶

Emitted by MOD-118 once per member per dividend declaration when the net credit is confirmed by MOD-001. Mutual-institution tenants only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
payment_id	uuid	✓	FK to `core.dividend_payments`
declaration_id	uuid	✓
member_id	uuid	✓
party_id	uuid	✓
gross_dividend	string	✓	Fixed-point decimal
tax_withheld	string	✓	Fixed-point decimal
net_dividend	string	✓	Fixed-point decimal
posting_id	uuid	✓	SD01 posting reference
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-063 (member notification — "dividend credited to your account"), MOD-022 (audit trail).

`bank.core.member_status_changed`¶

Emitted by MOD-118 on any member register status transition (APPLICANT → MEMBER, MEMBER → SUSPENDED, MEMBER → FORMER, etc.). Mutual-institution tenants only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
member_id	uuid	✓
party_id	uuid	✓
status_from	string	✓	Previous status
status_to	string	✓	New status
reason	string	✗	Present for SUSPENDED and FORMER transitions
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-063 (member notification on status changes), MOD-022 (audit trail).

`bank.core.member_statement_due`¶

Emitted by MOD-118 once per active member at FY end, carrying the full annual statement data payload. MOD-113 subscribes when deployed and renders the statement for delivery via MOD-073 + email. Deferred rendering path — FR-536 delivery is pending MOD-113 (Gap #2 ruling — Option C). Mutual-institution tenants only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
member_id	uuid	✓
party_id	uuid	✓
fy_end_date	string	✓	ISO 8601 date
opening_shares	string	✓	Fixed-point decimal
closing_shares	string	✓	Fixed-point decimal
transactions	array	✓	Array of `{tx_id, tx_type, shares, total_amount, created_at}`
dividends_declared	array	✓	Array of `{declaration_id, gross_dividend, tax_withheld, net_dividend, paid_at}`
last_voted_at	string	✗	ISO 8601 date; null if did not vote
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-113 (annual statement rendering + MOD-073 storage + email delivery — pending MOD-113 deployment).

`bank.core.tax_certificate_due`¶

Emitted by MOD-118 once per member who received a dividend payment during the FY. MOD-113 subscribes when deployed and renders the tax certificate. Deferred rendering path — FR-535 delivery pending MOD-113 (Gap #2 ruling — Option C). Mutual-institution tenants only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
member_id	uuid	✓
party_id	uuid	✓
fy_end_date	string	✓	ISO 8601 date
total_gross_dividend	string	✓	Fixed-point decimal — sum for the year
total_tax_withheld	string	✓	Fixed-point decimal
total_net_dividend	string	✓	Fixed-point decimal
dividend_payments	array	✓	Array of `{declaration_id, payment_date, gross_dividend, tax_withheld, net_dividend}`
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-113 (tax certificate rendering + MOD-073 storage + email delivery — pending MOD-113 deployment).

SD02 — KYC Platform (`bank-kyc` bus)¶

`bank.kyc.identity_verified`¶

Emitted by MOD-009 when an identity verification attempt produces a PASS result with sufficient confidence to proceed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓	Canonical cross-domain party reference — replaces earlier `customer_id`
verification_id	uuid	✓	FK to `kyc.kyc_checks.id`
document_type	string	✓	`PASSPORT` / `DRIVERS_LICENCE` / `NATIONAL_ID`
confidence_score	string	✓	Decimal string `"0.00"`–`"1.00"`
jurisdiction	string	✓	`NZ` / `AU`
kyc_status	string	✓	`VERIFIED` (FR-444 required field)
cdd_tier	string	✓	`SIMPLIFIED` / `STANDARD` / `ENHANCED` — derived by MOD-009 from score thresholds in FR-443; consumed by MOD-010 and MOD-007 (FR-444 required field)
edd_required	boolean	✓	True when confidence is 0.70–0.89 (VERIFIED but flagged for periodic review)
verified_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-010 (CDD tier assignment — primary consumer), MOD-013 (sanctions screener — triggers initial screen), MOD-012 (KYC audit trail), MOD-007 (account state machine — enables activation gate)

`bank.kyc.identity_failed`¶

Emitted by MOD-009 when a verification attempt produces a FAIL or irrecoverable REFER result that cannot proceed without manual intervention.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓	Canonical cross-domain party reference — replaces earlier `customer_id`
verification_id	uuid	✓	FK to `kyc.kyc_checks.id`
jurisdiction	string	✓	`NZ` / `AU` — consumers (MOD-007, MOD-018) need jurisdiction to route correctly
kyc_status	string	✓	`FAILED` or `PENDING_EDD`
failure_reason	string	✓	`DOCUMENT_REJECTED` / `BIOMETRIC_MISMATCH` / `WATCHLIST_HIT` / `UNSUPPORTED_DOCUMENT` / `EXPIRED_DOCUMENT`
confidence_score	string	✓	Decimal string — allows MOD-018 to assess whether EDD path is viable
attempt_number	integer	✓	Retry count
max_attempts_reached	boolean	✓
idempotency_key	string	✓

Consumers: MOD-018 (alert case management — creates manual review task), MOD-012 (KYC audit trail), MOD-063 (notification orchestration — customer notification)

`bank.kyc.cdd_tier_assigned`¶

Emitted by MOD-010 after CDD classification is complete for a customer.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
customer_id	uuid	✓
cdd_tier	string	✓	`LOW` / `MEDIUM` / `HIGH` / `ENHANCED`
previous_tier	string	✗	Omitted on initial assignment
tier_rationale	string	✓	Human-readable reason
sanctions_check_status	string	✓	`CLEAR` / `MATCH_FOUND` / `PENDING`
account_activation_permitted	boolean	✓
idempotency_key	string	✓

Consumers: MOD-007 (account state machine — activation gate), MOD-039 (customer risk score — informs risk model), MOD-016 (typology engine — AML risk parameter), MOD-012 (KYC audit trail)

`bank.kyc.sanctions_match_found`¶

Emitted by MOD-013 when a customer or payment counterparty matches an entry on OFAC, UN, MFAT, or DFAT lists.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
screening_id	uuid	✓
entity_type	string	✓	`CUSTOMER` / `COUNTERPARTY`
entity_id	uuid	✓	customer_id or counterparty reference
list_source	string	✓	`OFAC` / `UN` / `MFAT` / `DFAT`
match_score	string	✓	Decimal string `"0.00"`–`"1.00"`
match_type	string	✓	`EXACT` / `FUZZY` / `ALIAS`
triggering_context	string	✓	`ONBOARDING` / `PAYMENT` / `LIST_UPDATE` / `PERIODIC_REVIEW`
idempotency_key	string	✓

Consumers: MOD-007 (account state machine — immediate restriction), MOD-020 (pre-payment validation — blocks all payments), MOD-018 (alert case management — creates sanctions case), MOD-022 (payment audit trail)

`bank.kyc.sanctions_match_cleared`¶

Emitted by MOD-015 only when an adjudication resolves as FALSE_POSITIVE and the sanctions hold is lifted. Not emitted for CONFIRMED_MATCH or ESCALATED outcomes. Schema v1 registered by MOD-015.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
screening_id	uuid	✓	FK to originating `kyc.sanctions_results.id`
party_id	uuid		NULL for counterparty matches
queue_id	uuid	✓	FK to `kyc.fp_review_queue.id`
adjudication_id	uuid	✓	FK to `kyc.false_positive_decisions.id`
list_source	string	✓	e.g. `OFAC`, `UN`, `MFAT`
match_entry_id	string	✓	Sanctions list entry that was cleared
cleared_by	string	✓	Staff ID of adjudicating analyst
suppress_until	string	✓	`YYYY-MM-DD` — suppression window end date
idempotency_key	string	✓

Consumers: MOD-007 (account state machine — lifts restriction), MOD-020 (pre-payment validation — removes payment block), MOD-012 (KYC audit trail)

`bank.kyc.kyc_review_due`¶

Emitted by MOD-011 daily sweep at exact milestone days before/after due date, and for AML-003 expiring-document hits. Cadences: Simplified 1095d / Standard 730d / Enhanced 365d (FR-085). Milestone bands: T-60 / T-30 / T-7 / T_DUE / OVERDUE / DOCUMENT_EXPIRY.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
party_id	uuid	✓
schedule_id	uuid	✓	`periodic_review_schedule.id`; for DOCUMENT_EXPIRY carries document UUID
milestone	string	✓	`T_MINUS_60` / `T_MINUS_30` / `T_MINUS_7` / `T_DUE` / `OVERDUE` / `DOCUMENT_EXPIRY`
review_type	string	✓	`PERIODIC` / `DOCUMENT_EXPIRY`
due_date	string	✓	`YYYY-MM-DD`
days_overdue	integer		Present when milestone = `OVERDUE`; ≥ 1
expiring_document_id	uuid		Present when `review_type = DOCUMENT_EXPIRY`
current_cdd_tier	string	✓	`SIMPLIFIED` / `STANDARD` / `ENHANCED`
idempotency_key	string	✓

Consumers: MOD-062 (workflow orchestration — creates review task), MOD-064 (operations work queue — queues for analyst), MOD-063 (notification orchestration — may trigger customer outreach)

`bank.kyc.kyc_review_completed`¶

Emitted by MOD-011 when POST /kyc/reviews/complete records a successful periodic review. MOD-012 (KYC audit trail) consumes this to write an immutable audit entry (FR-088).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
party_id	uuid	✓
schedule_id	uuid	✓	`periodic_review_schedule.id`
kyc_check_id	uuid	✓	Inserted row in `kyc.kyc_checks`
outcome	string	✓	Review outcome (pass / refer / escalate)
reviewer_id	string	✓	Agent/user who completed the review
next_review_due	string	✓	`YYYY-MM-DD` — recalculated forward date
idempotency_key	string	✓	Caller-supplied

Consumers: MOD-012 (KYC audit trail — writes immutable review record)

`bank.kyc.kyc_review_overdue_block`¶

Emitted by MOD-011 sweep when a review is ≥ 15 days overdue (14-day grace, FR-087). MOD-007 (account state machine) consumes this to restrict new-product origination until the review is completed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
party_id	uuid	✓
schedule_id	uuid	✓	`periodic_review_schedule.id`
due_date	string	✓	`YYYY-MM-DD` — original due date
days_overdue	integer	✓	≥ 15
idempotency_key	string	✓

Consumers: MOD-007 (account state machine — restricts new-product origination)

`bank.kyc.false_positive_recorded`¶

Emitted by MOD-013 (back-office FR-452 API path) and MOD-015 (analyst workflow adjudication path) on every adjudication decision regardless of outcome. Both publish the same v1 schema; MOD-013 owns schema registration. MOD-015 projects non-standard list_source values (e.g. REFINITIV, DOW_JONES) to the nearest standard enum value for v1 compatibility; a v2 schema bump will widen the enum when confirmed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
screening_id	uuid	✓	FK to `kyc.sanctions_results.id`
party_id	uuid	✓
list_source	string	✓	`OFAC` / `UN` / `MFAT` / `DFAT` (v1 enum)
decision	string	✓	`FALSE_POSITIVE` / `CONFIRMED_MATCH` / `ESCALATED`
adjudicated_by	string	✓	Staff ID of analyst
decision_rationale	string	✓	≥ 20 characters
reason_code	string	✓	Stable false-positive category
idempotency_key	string	✓

Consumers: MOD-012 (KYC audit trail), MOD-037 (AML reporting pipeline — RBNZ/AUSTRAC disclosures)

`bank.kyc.list_updated`¶

Emitted by MOD-014 when a sanctions list version transitions to ACTIVE (ingest + activate path) or when a list is ROLLED_BACK to a previous version within the 48-hour rollback window. The list_id is the kyc.sanctions_lists.id of the newly-active version. Consumers use this event as the trigger for list-change re-screening of the full customer portfolio.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
list_id	uuid	✓	FK to `kyc.sanctions_lists.id` — the newly-active version
list_source	string	✓	`OFAC` / `UN` / `MFAT` / `DFAT` / `REFINITIV` / `DOW_JONES`
list_version	string	✓	Provider-stamped version identifier
previous_version	string		Previous active version; null on first ingest
change_type	string	✓	`ACTIVATED` / `ROLLED_BACK`
entry_count	integer	✓	Total entries in the now-active version
added_count	integer	✓	Diff: entries added vs previous version
removed_count	integer	✓	Diff: entries removed vs previous version
modified_count	integer	✓	Diff: entries modified vs previous version
idempotency_key	string	✓	Deduplication key (list_id + change_type)
trace_id	string

Consumers: MOD-013 (sanctions screening — triggers LIST_UPDATE re-screen of all active parties), MOD-037 (AML reporting)

`bank.kyc.acceptance_decided`¶

Emitted by MOD-153 (customer acceptance engine) after persisting an acceptance decision to kyc.acceptance_decisions. Published to the bank-kyc bus before any downstream side-effects. FR-715 requires the corresponding bank.platform.system_decision_recorded to be published to the bank-platform bus in the same handler flow, before downstream activation.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
party_id	uuid	✓
product_id	text	✓
decision	string	✓	`ACCEPT` / `DECLINE` / `REFER` / `HOLD_FOR_EDD`
product_category	string	✓	`CREDIT` / `DEPOSIT` / `PAYMENT` / `OTHER` — FR-714 adverse-action routing
reason_codes	string[]	✓	Machine-readable codes e.g. `["CDD_TIER_INSUFFICIENT"]`
decision_at	ISO8601	✓	Matches `kyc.acceptance_decisions.decision_at`
methodology_version	string	✓	Rule-set release identifier — AML-012 traceability
re_evaluation_trigger	string	✗	Present on FR-716 re-evals; null on initial evaluation
trace_id	string	✓
idempotency_key	string	✓

Consumers: MOD-007 (account activation gate — v2 follow-on; reads kyc.acceptance_decisions view before PENDING→ACTIVE), MOD-048 (system decision log — FR-715; receives bank.platform.system_decision_recorded cross-bus), MOD-063 (adverse action notice — FR-714; filters on decision=DECLINE AND product_category=CREDIT; event-driven stub in v1), MOD-151 / MOD-053 (risk case creation — FR-713; filters on decision IN (REFER, HOLD_FOR_EDD); event-driven fan-out)

SD03 — AML Monitoring (`bank-aml` bus)¶

`bank.aml.alert_raised`¶

Emitted by MOD-016 (rule-based typology) or MOD-017 (ML behavioural scoring) when a transaction or behavioural pattern crosses an alert threshold.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
alert_id	uuid	✓
alert_source	string	✓	`RULE_ENGINE` / `ML_MODEL`
customer_id	uuid	✓
alert_type	string	✓	FATF typology code e.g. `STRUCTURING`, `RAPID_MOVEMENT`, `UNUSUAL_CROSS_BORDER`
risk_score	string	✓	Decimal string `"0"`–`"100"`
triggering_transaction_ids	array of uuid	✗	Present when alert is transaction-specific
rule_ids	array of string	✗	Present when `alert_source` is `RULE_ENGINE`
idempotency_key	string	✓

Consumers: MOD-018 (alert case management — primary consumer, creates analyst queue entry), MOD-022 (payment audit trail), MOD-042 (CDC → Snowflake)

`bank.aml.case_opened`¶

Emitted by MOD-018 when an alert is promoted to a formal AML investigation case.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
case_id	uuid	✓
alert_id	uuid	✓	Causal alert reference
customer_id	uuid	✓
assigned_analyst	string	✗	Agent ID; null if unassigned
priority	string	✓	`LOW` / `MEDIUM` / `HIGH` / `CRITICAL`
idempotency_key	string	✓

Consumers: MOD-064 (operations work queue), MOD-047 (agent action logger), MOD-042 (CDC → Snowflake)

`bank.aml.case_escalated`¶

Emitted by MOD-018 when a case is escalated to MLRO or senior analyst review.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
case_id	uuid	✓
escalated_to	string	✓	`MLRO` / `SENIOR_ANALYST` / `BOARD`
escalation_reason	string	✓	Human-readable
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — MLRO notification), MOD-047 (agent action logger), MOD-042 (CDC → Snowflake)

`bank.aml.case_closed`¶

Emitted by MOD-018 when a case is closed with a final disposition.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
case_id	uuid	✓
customer_id	uuid	✓
disposition	string	✓	`SAR_FILED` / `NO_ACTION` / `ENHANCED_MONITORING` / `ACCOUNT_CLOSED`
closed_by	string	✓	Agent ID
sar_reference	string	✗	Present when `disposition` is `SAR_FILED`
idempotency_key	string	✓

Consumers: MOD-019 (regulatory report submission — when SAR filed), MOD-039 (customer risk score — re-scores on close), MOD-012 (KYC audit trail), MOD-042 (CDC → Snowflake)

`bank.aml.regulatory_submission_completed`¶

Emitted by MOD-019 after a SAR, IFTI, or CMIR is successfully submitted to AUSTRAC or RBNZ/FMA.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
submission_id	uuid	✓
report_type	string	✓	`SAR` / `IFTI` / `CMIR`
jurisdiction	string	✓	`NZ` / `AU`
regulator	string	✓	`AUSTRAC` / `RBNZ` / `FMA`
case_id	uuid	✗	Present when linked to a case
submitted_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-047 (agent action logger — immutable record), MOD-048 (system decision log), MOD-042 (CDC → Snowflake)

SD04 — Payments (`bank-payments` bus)¶

`bank.payments.payment_initiated`¶

Emitted by MOD-020 (pre-payment validation) when a payment instruction is received and passes initial structural validation, before full validation and posting.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
payment_id	uuid	✓	Stable payment reference
customer_id	uuid	✓
source_account_id	uuid	✓
destination_account_id	uuid	✗	Internal transfers only
destination_bsb_account	string	✗	External AU payments
destination_sort_account	string	✗	External NZ payments
amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
payment_type	string	✓	`INTERNAL` / `DOMESTIC` / `INTERNATIONAL` / `FX`
channel	string	✓	`APP` / `API` / `OPEN_BANKING` / `AGENT`
trace_id	uuid	✓	ADR-031 trace propagation
idempotency_key	string	✓	Caller-supplied

Consumers: MOD-022 (payment audit trail — opens audit record), MOD-023 (transaction fraud scorer — immediate scoring trigger), MOD-024 (device & session intelligence)

`bank.payments.payment_validated`¶

Emitted by MOD-020 when all pre-payment validation checks pass and the payment is cleared for posting.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
payment_id	uuid	✓
validation_checks_passed	array of string	✓	e.g. `["BALANCE", "LIMITS", "SANCTIONS", "FRAUD", "ACCOUNT_STATUS"]`
fraud_score	string	✓	Decimal string from MOD-023
trace_id	uuid	✓	ADR-031 trace propagation
idempotency_key	string	✓

Consumers: MOD-001 (posting engine — proceeds to ledger posting), MOD-022 (payment audit trail)

`bank.payments.payment_completed`¶

Emitted by MOD-022 (triggered by bank.core.posting_completed) once the ledger posting is confirmed and settlement is initiated. MOD-022's audit-consumer processes the core posting event, writes the SETTLEMENT_CONFIRMED audit row, and re-emits this event on the bank-payments bus to close the SD04→SD01→SD04 loop that rail integrations need.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
trace_id	uuid	✓	ADR-031 trace propagation
payment_id	uuid	✓
posting_id	uuid	✓	Ledger posting reference
customer_id	uuid	✓
amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
payment_type	string	✓
settled_at	ISO8601	✗	Present when settled in same event cycle
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — payment confirmation), MOD-026 (IFTI/CMIR trigger — threshold check), MOD-039 (customer risk score — transaction signal), MOD-042 (CDC → Snowflake), MOD-070 (transaction history)

`bank.payments.payment_failed`¶

Emitted by MOD-020 or MOD-001 when a payment cannot be completed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
payment_id	uuid	✓
customer_id	uuid	✓
failure_stage	string	✓	`VALIDATION` / `FRAUD_BLOCK` / `SANCTIONS_BLOCK` / `POSTING`
failure_code	string	✓	Stable machine key
failure_message	string	✓	Human-readable operator message
trace_id	uuid	✓	ADR-031 trace propagation
idempotency_key	string	✓

Consumers: MOD-022 (payment audit trail), MOD-063 (notification orchestration — customer notification), MOD-042 (CDC → Snowflake)

`bank.payments.payment_reversed`¶

Emitted by MOD-001 (general reversals), MOD-119 (BPAY returns), MOD-120 (Osko returns), and MOD-122 (NZ interbank returns) after a reversal posting pair is committed to the ledger.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
payment_id	uuid	✓	Original payment reference
reversal_posting_id	uuid	✓
customer_id	uuid	✓
amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
reversal_reason	string	✓	`CUSTOMER_REQUEST` / `FRAUD` / `SETTLEMENT_FAILURE` / `COMPLIANCE_HOLD` / `BPAY_RETURN` / `OSKO_RETURN` / `NZ_INTERBANK_RETURN`
reversed_by	string	✓	Agent ID, `SYSTEM`, `BPAY_SCHEME`, `NPP_SCHEME`, or `NZ_PAYMENTS_NZ_SCHEME`
idempotency_key	string	✓
trace_id	uuid	✓	ADR-031 trace propagation

Consumers: MOD-022 (payment audit trail), MOD-063 (notification orchestration), MOD-042 (CDC → Snowflake)

`bank.payments.fx_rate_locked`¶

Emitted by MOD-025 when an FX rate lock is granted to a payment instruction. Lock duration is 30–60 seconds; expired locks must trigger a new lock request.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
lock_id	uuid	✓
payment_id	uuid	✓
source_currency	string	✓	ISO 4217
target_currency	string	✓	ISO 4217
rate	string	✓	Fixed-point decimal — locked rate
inverse_rate	string	✓	For display purposes
source_amount	string	✓	Fixed-point decimal
target_amount	string	✓	Fixed-point decimal
lock_expires_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-022 (payment audit trail), MOD-082 (nostro & FX treasury — hedging trigger)

`bank.payments.fx_conversion_completed`¶

Emitted by MOD-025 when the FX conversion posting pair is committed and settlement is instructed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
conversion_id	uuid	✓
lock_id	uuid	✓	Reference to `bank.payments.fx_rate_locked`
payment_id	uuid	✓
source_posting_id	uuid	✓	Debit ledger posting
target_posting_id	uuid	✓	Credit ledger posting
source_currency	string	✓
target_currency	string	✓
source_amount	string	✓	Fixed-point decimal
target_amount	string	✓	Fixed-point decimal
rate_applied	string	✓	Fixed-point decimal
idempotency_key	string	✓

Consumers: MOD-022 (payment audit trail), MOD-082 (nostro & FX treasury), MOD-042 (CDC → Snowflake)

`bank.payments.limit_breach_detected`¶

Emitted by MOD-021 when a payment instruction would exceed a customer's per-transaction or daily velocity limit.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
payment_id	uuid	✓
customer_id	uuid	✓
limit_type	string	✓	`DAILY_VALUE` / `PER_TRANSACTION` / `DAILY_COUNT`
limit_value	string	✓	Fixed-point decimal
attempted_value	string	✓	Fixed-point decimal
idempotency_key	string	✓

Consumers: MOD-020 (pre-payment validation — blocks payment), MOD-022 (payment audit trail), MOD-016 (typology engine — structuring signal), MOD-063 (notification orchestration — customer notification of breach via FR-128)

`bank.payments.approval_required`¶

Emitted by MOD-021 when a payment instruction exceeds the configured multi-step approval threshold. The payment is held; the approval workflow is owned by MOD-062.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	"1"
payment_id	uuid	✓
customer_id	uuid	✓
amount	string	✓	Fixed-point decimal
currency	string	✓
approval_threshold	string	✓	Fixed-point decimal threshold that was exceeded
required_approver_count	int	✓	Number of approvals required to release
expires_at	ISO8601	✓	Payment hold expiry; if not approved by this time, auto-cancelled
idempotency_key	string	✓

Consumers: MOD-062 (workflow orchestration — approval chain state machine), MOD-022 (payment audit trail), MOD-063 (notification orchestration — approval request to designated approvers)

`bank.payments.approval_granted`¶

Emitted by MOD-062 when a multi-step approval chain completes and the payment is released for execution.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	"1"
payment_id	uuid	✓
customer_id	uuid	✓
approved_by	array	✓	List of approver IDs who completed the chain
workflow_id	uuid	✓	MOD-062 workflow instance ID

Consumers: MOD-020 (pre-payment validation — re-enters payment into execution pipeline), MOD-063 (notification — payment released confirmation to initiator)

`bank.payments.approval_rejected`¶

Emitted by MOD-062 when a multi-step approval chain is rejected or expires without sufficient approvals.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	"1"
payment_id	uuid	✓
customer_id	uuid	✓
rejection_reason	string	✓	`APPROVER_REJECTED` / `EXPIRED` / `INSUFFICIENT_APPROVALS`
workflow_id	uuid	✓	MOD-062 workflow instance ID

Consumers: MOD-022 (payment audit trail — terminal state for held payment), MOD-063 (notification — payment declined notification to initiator)

`bank.payments.ifti_threshold_crossed`¶

Emitted by MOD-026 when a cross-border electronic transfer triggers an IFTI reporting obligation, or when a physical cash movement meets the CMIR threshold. IFTI-E has no monetary minimum — every cross-border electronic transfer is reportable; the applied threshold is configurable per jurisdiction via SSM/AppConfig (production default: every cross-border transfer).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
payment_id	uuid	✓
customer_id	uuid	✓
amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
direction	string	✓	`INBOUND` / `OUTBOUND`
counterparty_country	string	✓	ISO 3166-1 alpha-2
report_type	string	✓	`IFTI` / `CMIR`
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-019 (regulatory report submission — files IFTI/CMIR), MOD-022 (payment audit trail)

`bank.payments.settlement_file_received`¶

Emitted by MOD-081 when an inbound settlement file is received from a payment rail (NPP, RTGS, SWIFT, DIRECT_ENTRY, BPAY, CARD).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
file_id	uuid	✓	FK to `payments.settlement_files.id`
rail	string	✓	`NPP` / `RTGS` / `SWIFT` / `DIRECT_ENTRY` / `BPAY` / `CARD` — matches `payments.settlement_files.rail` CHECK enum
settlement_date	string	✓	`YYYY-MM-DD`
transaction_count	integer	✓
total_value	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
idempotency_key	string	✓

Consumers: MOD-081 (reconciliation engine — self-consume to trigger matching run), MOD-082 (nostro & FX treasury — position update)

`bank.payments.reconciliation_exception_raised`¶

Emitted by MOD-081 when a settlement item cannot be matched to a payment instruction, or when a mismatch is detected during reconciliation.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
exception_id	uuid	✓	FK to `payments.reconciliation_exceptions.id`
payment_id	uuid	✗	NULL for inbound unmatched items with no matched instruction
settlement_file_id	uuid	✓
exception_type	string	✓	`UNMATCHED_OUTBOUND` / `SHORT_SETTLED` / `OVER_SETTLED` / `DUPLICATE` / `MISSING_RETURN` / `UNMATCHED_INBOUND` — matches `payments.reconciliation_exceptions.exception_type` CHECK enum
instructed_amount	string	✗	Fixed-point decimal; NULL for UNMATCHED_INBOUND
settled_amount	string	✓	Fixed-point decimal
variance	string	✗	Fixed-point decimal, signed (instructed − settled); NULL for UNMATCHED_OUTBOUND / UNMATCHED_INBOUND
currency	string	✓	ISO 4217
rail	string	✓	Matches `payments.settlement_files.rail` CHECK enum
idempotency_key	string	✓

Consumers: MOD-064 (operations work queue — creates reconciliation task, when built), MOD-047 (agent action logger), MOD-042 (CDC → Snowflake)

`bank.payments.reconciliation_daily_summary`¶

Emitted by MOD-081 daily-report Lambda after aggregating the day's reconciliation results per rail. The corresponding row is written to payments.reconciliation_daily_summary in Postgres before the event fires. MOD-042 replicates the table to Snowflake for treasury analysis and visualisation.

Bus: bank-payments · Source: bank.payments · Detail-type: reconciliation_daily_summary

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
summary_id	uuid	✓	FK to `payments.reconciliation_daily_summary.id`
report_date	string	✓	`YYYY-MM-DD`
rail	string	✓	Matches `payments.settlement_files.rail` CHECK enum
currency	string	✓	ISO 4217
total_count	integer	✓	Total items in settlement files for this rail/date
matched_count	integer	✓
unmatched_count	integer	✓
short_settled_count	integer	✓
over_settled_count	integer	✓
duplicate_count	integer	✓
missing_return_count	integer	✓
total_instructed_amount	string	✓	Fixed-point decimal
total_settled_amount	string	✓	Fixed-point decimal
net_variance	string	✓	Fixed-point decimal, signed
open_exceptions_count	integer	✓	Open + under-review at time of report
escalated_exceptions_count	integer	✓
idempotency_key	string	✓

Consumers: MOD-042 (CDC → Snowflake — daily summary table replicated for treasury analytics), MOD-047 (agent action logger)

`bank.payments.nostro_threshold_breached`¶

Emitted by MOD-082 when a nostro position's current_balance crosses the configured minimum_threshold (under-funded) or maximum_threshold (over-funded). Triggers treasury action.

Bus: bank-payments · Source: bank.payments · Detail-type: nostro_threshold_breached

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	semver string
trace_id	string	✓
position_id	string	✓	UUID — FK to `payments.nostro_positions`
correspondent_bank	string	✓	BIC or internal code
nostro_account_ref	string	✓
currency	string	✓	ISO 4217
threshold_kind	string	✓	`MINIMUM` / `MAXIMUM`
current_balance	string	✓	Fixed-point decimal
threshold_value	string	✓	Fixed-point decimal
idempotency_key	string	✓

Consumers: MOD-022 (payment audit trail), MOD-064 (operations work queue — treasury action task, when deployed)

`bank.payments.device_anomaly_detected`¶

Emitted by MOD-024 (device & session intelligence) whenever an anomaly is detected during session observation (observe-device path) or payment device check (check-device path).

Bus: bank-payments · Source: bank.payments · Detail-type: device_anomaly_detected

Field	Type	Required	Notes
event_id	string	✓	UUID
event_time	ISO8601	✓
schema_version	string	✓	semver string
trace_id	string	✓
anomaly_id	string	✓	UUID — FK to `payments.device_anomalies.id`
customer_id	string	✓	UUID
device_fingerprint_hash	string	✓	Same hash used by MOD-068 `access.device_registry`
anomaly_type	string	✓	`NEW_DEVICE` / `KNOWN_FRAUD_DEVICE` / `IMPOSSIBLE_TRAVEL` / `EMULATOR_DETECTED` / `ROOTED_DEVICE`
severity	string	✓	`INFO` / `WARN` / `CRITICAL`
action_recommended	string	✓	`NONE` / `STEP_UP` / `BLOCK`
session_id	string	✓	UUID
payment_id	string	✗	UUID; populated when anomaly detected via check-device (payment-specific); null on observe path
idempotency_key	string	✓

Consumers: MOD-022 (payment audit trail — links anomaly to payment audit record via payment_id), MOD-018 (case management — future, when deployed), MOD-068 (step-up authentication — future; could subscribe to drive STEP_UP/BLOCK actions directly)

`bank.payments.direct_debit_mandate_created`¶

Emitted by MOD-114 when a new mandate is registered (customer in-app pre-approval or biller-initiated authorisation processed by the bank).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0"`
trace_id	string	✓
idempotency_key	string	✓
mandate_id	string	✓	UUID of the new mandate
party_id	string	✓
account_id	string	✓
jurisdiction	string	✓	`"NZ"` or `"AU"`
biller_id	string	✓
biller_name	string	✓
max_amount	number	✗	Null if no cap set
frequency	string	✗	`WEEKLY` / `FORTNIGHTLY` / `MONTHLY` / `VARIABLE`
effective_date	string	✓	ISO8601 date

Consumers: MOD-063 (sends "Mandate created" confirmation to customer).

`bank.payments.direct_debit_mandate_cancelled`¶

Emitted by MOD-114 when a customer cancels a mandate (FR-507). Effective immediately — subsequent debit presentations from that biller return MANDATE_CANCELLED.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0"`
trace_id	string	✓
idempotency_key	string	✓
mandate_id	string	✓
party_id	string	✓
account_id	string	✓
jurisdiction	string	✓
biller_id	string	✓
biller_name	string	✓
cancel_reason	string	✗	Customer or system reason
cancelled_at	string	✓	ISO8601

Consumers: MOD-063 (sends "Mandate cancelled" notification to customer per FR-507).

`bank.payments.direct_debit_dishonoured`¶

Emitted by MOD-114 when a debit presentation is returned due to dishonour (insufficient funds, account blocked, etc.). Triggers fee assessment and customer notification (FR-508).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0"`
trace_id	string	✓
idempotency_key	string	✓
presentation_id	string	✓	UUID of the failed presentation
mandate_id	string	✓
party_id	string	✓
account_id	string	✓
jurisdiction	string	✓
biller_id	string	✓
biller_name	string	✓
amount	number	✓
currency	string	✓	`"NZD"` or `"AUD"`
return_code	string	✓	Scheme return code (DDR or BECS)
return_reason	string	✓	Plain-language reason for customer notification
dishonour_fee_assessed	boolean	✓	True if MOD-110 assessed a dishonour fee

Consumers: MOD-063 (sends "Direct debit returned — biller name + reason" notification within 60 s per FR-508), MOD-022 (payment audit trail).

`bank.payments.bpay_biller_registered`¶

Emitted by MOD-136 when a business customer's BPAY biller registration moves to ACTIVE status (sponsor has assigned and confirmed a BPAY code). AU-only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
biller_id	uuid	✓	FK to `payments.bpay_inbound_billers`
party_id	uuid	✓	Business customer party
bpay_code	string	✓	BPAY biller code assigned by sponsor
biller_name	string	✓
jurisdiction	string	✓	`AU`
trace_id	string	✓

Consumers: MOD-063 (back-office notification to staff that biller is now ACTIVE).

`bank.payments.bpay_inbound_received`¶

Emitted by MOD-136 after a successful MOD-001 credit posting for an inbound BPAY payment. Triggers biller notification within 60 s (FR-607 / CON-005). AU-only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
payment_id	uuid	✓	FK to synthetic `payments.payments` row
posting_id	uuid	✓	SD01 posting reference from MOD-001 credit
biller_id	uuid	✓
bpay_code	string	✓
crn	string	✓	Customer reference number — validated before this event is emitted
amount	string	✓	Fixed-point decimal e.g. `"123.45"`
currency	string	✓	`AUD`
settlement_date	string	✓	ISO 8601 date
settlement_batch_reference	string	✓	Sponsor's batch reference
trace_id	string	✓

Consumers: MOD-063 (biller notification — "BPAY payment received" within 60 s per FR-607), MOD-022 (payment audit trail).

`bank.payments.bpay_inbound_returned`¶

Emitted by MOD-136 when an inbound BPAY payment fails CRN validation and is quarantined as RETURNED. Triggers ops-queue notification and the scheme return mechanism (FR-606). AU-only.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
payment_id	uuid	✓
biller_id	uuid	✓
bpay_code	string	✓
crn	string	✓	The CRN as received — invalid
amount	string	✓	Fixed-point decimal
currency	string	✓	`AUD`
return_reason_code	string	✓	Scheme return reason code
settlement_batch_reference	string	✓
trace_id	string	✓

Consumers: MOD-063 (ops-queue alert — quarantined item within 60 min per FR-606), MOD-022 (payment audit trail).

`bank.payments.batch_validated`¶

Emitted by MOD-135 when a batch file passes format validation (FR-601) and the MOD-020 aggregate balance gate (FR-602). Batch moves to PENDING_APPROVAL; customer must confirm before processing begins (CON-005).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓	FK to `payments.batch_files`
party_id	uuid	✓	Business/SME customer party
account_id	uuid	✓	Source debit account
file_format	string	✓	`ABA` or `CSV`
validated_item_count	integer	✓
validated_total_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO-4217
jurisdiction	string	✓	`NZ` or `AU`
shortfall_amount	string		Present if insufficient funds — customer must confirm partial-funding intent
trace_id	string	✓

Consumers: MOD-063 (customer notification: batch ready for confirmation).

`bank.payments.batch_confirmed`¶

Emitted by MOD-135 when the customer explicitly confirms the batch (CON-005). Processing begins immediately after this event.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
party_id	uuid	✓
account_id	uuid	✓
item_count	integer	✓
total_amount	string	✓	Fixed-point decimal
currency	string	✓
jurisdiction	string	✓
trace_id	string	✓

Consumers: (triggers batch submission orchestrator internally).

`bank.payments.batch_item_quarantined`¶

Emitted by MOD-135 per item that receives a fraud or sanctions alert from the per-item MOD-020 call (FR-603). Must be published within 60 s of batch submission; quarantined items do not block sibling items.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
item_id	uuid	✓	FK to `payments.batch_items`
payment_id	uuid	✓	MOD-135-minted payment_id for this item
party_id	uuid	✓
amount	string	✓	Fixed-point decimal
currency	string	✓
quarantine_reason	string	✓	MOD-020 `failure_reason` e.g. `SANCTIONS_MATCH`, `FRAUD_BLOCK`
sequence_number	integer	✓	Position in source file
trace_id	string	✓

Consumers: MOD-063 (customer notification of quarantined item within 60 s per FR-603).

`bank.payments.batch_item_returned`¶

Emitted by MOD-135 when an item cannot be credited (account closed, invalid account) and a re-credit has been posted to the source account (FR-604).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
item_id	uuid	✓
payment_id	uuid	✓
party_id	uuid	✓
amount	string	✓	Fixed-point decimal — returned amount
currency	string	✓
return_reason	string	✓	e.g. `ACCOUNT_CLOSED`, `INVALID_ACCOUNT`
return_posting_id	uuid	✓	Re-credit posting to source account
sequence_number	integer	✓
trace_id	string	✓

Consumers: MOD-063 (return notification to customer per FR-604).

`bank.payments.batch_settled`¶

Emitted by MOD-135 when all non-quarantined, non-failed items have reached a terminal state (SETTLED, RETURNED, or FAILED). Terminal success event for the batch.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
party_id	uuid	✓
account_id	uuid	✓
settled_item_count	integer	✓	Items that reached SETTLED
settled_total_amount	string	✓	Fixed-point decimal
quarantined_item_count	integer	✓	Items held as QUARANTINED
returned_item_count	integer	✓	Items returned (FR-604)
currency	string	✓
jurisdiction	string	✓
settled_at	string	✓	ISO8601 UTC
trace_id	string	✓

Consumers: MOD-063 (batch settlement confirmation to customer), MOD-022 (payment audit trail).

`bank.payments.batch_failed`¶

Emitted by MOD-135 on a batch-level failure (source account closed mid-batch, system error during processing). Items not yet submitted at failure are not charged.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
party_id	uuid	✓
account_id	uuid	✓
failure_reason	string	✓	e.g. `SOURCE_ACCOUNT_CLOSED`, `SUBMISSION_TIMEOUT`
items_submitted	integer	✓	Items that reached MOD-020 before failure
items_not_submitted	integer	✓	Items not yet processed
currency	string	✓
jurisdiction	string	✓
trace_id	string	✓

Consumers: MOD-063 (failure notification to customer), MOD-022 (payment audit trail).

`bank.payments.agency_batch_received`¶

Emitted by MOD-137 when an agency batch file has landed in S3, been parsed, and per-item processing has been queued. File-level idempotency key is file_reference.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓	FK to `payments.agency_batch_files`
agency_network	string	✓	`AUSTRALIA_POST` \| `NZ_POST` \| `OTHER`
file_reference	string	✓	Network-assigned file identifier
batch_date	string	✓	ISO-8601 date — transaction date from file header
declared_item_count	integer	✓
jurisdiction	string	✓	`NZ` or `AU`
trace_id	string	✓

Consumers: MOD-022 (payment audit trail).

`bank.payments.agency_batch_settled`¶

Emitted by MOD-137 when all items in the batch have reached a terminal state and the reconciliation pass is complete.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
agency_network	string	✓
posted_count	integer	✓	Items that reached POSTED
posted_total_amount	string	✓	Fixed-point decimal
quarantined_count	integer	✓	Items held as QUARANTINED
currency	string	✓	ISO-4217
jurisdiction	string	✓
settled_at	string	✓	ISO8601 UTC
trace_id	string	✓

Consumers: MOD-063 (batch settlement summary to customer), MOD-022 (payment audit trail).

`bank.payments.agency_item_quarantined`¶

Emitted by MOD-137 per item that fails account matching, account-active validation, or available-balance check (FR-609). Must be published within 2 hours of batch receipt.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
transaction_id	uuid	✓	FK to `payments.agency_transactions`
agency_network	string	✓
transaction_type	string	✓	`DEPOSIT` \| `WITHDRAWAL`
amount	string	✓	Fixed-point decimal
currency	string	✓
failure_reason	string	✓	`ACCOUNT_NOT_FOUND` \| `ACCOUNT_INACTIVE` \| `INSUFFICIENT_BALANCE` \| `PARSE_ERROR`
terminal_id	string	✓
agent_outlet_code	string	✓
sequence_number	integer	✓	Position in source file
trace_id	string	✓

Consumers: MOD-063 (ops queue notification per FR-609).

`bank.payments.agency_aml_threshold_flagged`¶

Emitted by MOD-137 for each agency cash transaction at or above the jurisdiction-specific AML reporting threshold (default AUD/NZD 10,000). Published in the same handler invocation as the MOD-001 posting — the flag never delays the transaction (FR-611). Carries terminal_id and agent_outlet_code as required location metadata.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
transaction_id	uuid	✓	FK to `payments.agency_transactions`
account_id	uuid	✓	Resolved account — soft ref SD01
transaction_type	string	✓	`DEPOSIT` \| `WITHDRAWAL`
amount	string	✓	Fixed-point decimal
currency	string	✓	ISO-4217
jurisdiction	string	✓	`NZ` or `AU`
threshold_value	string	✓	Threshold that was triggered (e.g. `"10000.00"`)
terminal_id	string	✓	FR-611 required location metadata
agent_outlet_code	string	✓	FR-611 required location metadata
trace_id	string	✓

Consumers: SD03 MOD-016 (typology engine — cash transaction analysis), SD06 MOD-037 (CDC consumer — regulatory reporting pipeline).

`bank.payments.agency_reconciliation_discrepancy`¶

Emitted by MOD-137 when the reconciliation pass (FR-612) finds a mismatch between processed totals and the agency network's settlement file. Must be published within 2 hours of reconciliation completing.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
batch_id	uuid	✓
agency_network	string	✓
discrepancy_type	string	✓	`COUNT_MISMATCH` \| `AMOUNT_MISMATCH` \| `BOTH`
expected_count	integer	✓	From settlement file
actual_count	integer	✓	Items processed by MOD-137
expected_amount	string	✓	Fixed-point decimal — settlement file total
actual_amount	string	✓	Fixed-point decimal — MOD-137 processed total
currency	string	✓	ISO-4217
jurisdiction	string	✓
trace_id	string	✓

Consumers: MOD-063 (ops queue alert per FR-612; escalation to agency network within 1 business day if unresolved), MOD-022 (payment audit trail).

`bank.payments.card_ordered`¶

Emitted by MOD-124 when a physical card order is submitted to the bureau.

Bus: bank-payments · Source: bank.payments · Detail-type: card_ordered

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
card_id	uuid	✓	`payments.physical_cards(id)`
party_id	uuid	✓
account_id	uuid	✓
card_scheme	string	✓	`VISA` \| `MASTERCARD`
jurisdiction	string	✓	`NZ` \| `AU`
bureau_order_ref	string	✓	Bureau tracking reference
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (notify customer — card ordered confirmation).

`bank.payments.card_dispatched`¶

Emitted by MOD-124 when the bureau webhook confirms the card has been printed and dispatched to the customer address.

Bus: bank-payments · Source: bank.payments · Detail-type: card_dispatched

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
card_id	uuid	✓
party_id	uuid	✓
card_number_last4	string	✓	For display in customer notification
estimated_delivery_date	string	✗	ISO 8601 date if provided by bureau
pci_disclosure_required	boolean	✓	Always true; MOD-073 subscribes to deliver PCI disclosure document
bureau_order_ref	string	✓
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (dispatch notification to customer), MOD-073 (PCI disclosure document delivery — triggered by pci_disclosure_required: true).

`bank.payments.card_activated`¶

Emitted by MOD-124 when the customer successfully activates their physical card.

Bus: bank-payments · Source: bank.payments · Detail-type: card_activated

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
card_id	uuid	✓
party_id	uuid	✓
account_id	uuid	✓
card_number_last4	string	✓
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (activation confirmation notification), MOD-078 (card controls — initialise default control profile for this card once deployed).

`bank.payments.card_frozen`¶

Emitted by MOD-124 when a card is frozen (lost, stolen, or customer request). Separate from MOD-078 control-level freezes.

Bus: bank-payments · Source: bank.payments · Detail-type: card_frozen

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
card_id	uuid	✓
party_id	uuid	✓
freeze_reason	string	✓	`LOST` \| `STOLEN` \| `CUSTOMER_REQUEST` \| `SYSTEM`
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (freeze confirmation notification), MOD-022 (payment audit trail — freeze event).

`bank.payments.card_cancelled`¶

Emitted by MOD-124 when a card is permanently cancelled. Terminal state — no further events will be emitted for this card_id.

Bus: bank-payments · Source: bank.payments · Detail-type: card_cancelled

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
card_id	uuid	✓
party_id	uuid	✓
cancel_reason	string	✓	`LOST_STOLEN_REPLACEMENT` \| `CUSTOMER_REQUEST` \| `EXPIRY_REPLACED` \| `SYSTEM`
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (cancellation notification where cancel_reason = CUSTOMER_REQUEST), MOD-078 (remove control profile for cancelled card).

`bank.payments.card_replaced`¶

Emitted by MOD-124 when a replacement card order has been submitted following a lost/stolen report. The original card is simultaneously cancelled.

Bus: bank-payments · Source: bank.payments · Detail-type: card_replaced

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
original_card_id	uuid	✓	The cancelled card
replacement_card_id	uuid	✓	The newly ordered card
party_id	uuid	✓
replace_reason	string	✓	`LOST` \| `STOLEN` \| `DAMAGED`
bureau_order_ref	string	✓	Replacement order reference
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (replacement order confirmation notification).

`bank.payments.card_pin_changed`¶

Emitted by MOD-124 after the processor's HSM confirms a successful PIN change. No PIN data included — this is an audit event only.

Bus: bank-payments · Source: bank.payments · Detail-type: card_pin_changed

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
card_id	uuid	✓
party_id	uuid	✓
change_channel	string	✓	`APP` \| `ATM` \| `BRANCH`
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (PIN change confirmation notification — security event), MOD-022 (payment audit trail).

`bank.payments.card_renewed`¶

Emitted by MOD-124 when the 60-day pre-expiry EventBridge Scheduler scan orders a renewal card for an active card approaching expiry.

Bus: bank-payments · Source: bank.payments · Detail-type: card_renewed

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
expiring_card_id	uuid	✓	Card approaching expiry
renewal_card_id	uuid	✓	Newly ordered renewal card
party_id	uuid	✓
expiry_date	string	✓	ISO 8601 `YYYY-MM` of expiring card
bureau_order_ref	string	✓
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (renewal dispatch notification sent when card_dispatched subsequently fires for the renewal_card_id).

SD05 — Credit Decisioning (`bank-credit` bus)¶

`bank.credit.application_received`¶

Emitted by MOD-029 (pre-approval engine) or the credit application intake flow when a complete credit application is submitted.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
application_id	uuid	✓
customer_id	uuid	✓
product_id	string	✓	e.g. `PRD-002`
requested_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
application_source	string	✓	`APP` / `AGENT` / `PRE_APPROVAL`
idempotency_key	string	✓

Consumers: MOD-027 (affordability calculator — starts assessment), MOD-028 (credit score & risk rating), MOD-062 (workflow orchestration)

`bank.credit.credit_decision_made`¶

Emitted by MOD-029 (pre-approval engine) when a credit decision is recorded in credit.credit_decisions — whether from a live synchronous application or the nightly pre-approval batch.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
application_id	uuid	✓
customer_id	uuid	✓
decision_type	string	✓	`APPROVE` / `CONDITIONALLY_APPROVE` / `DECLINE` / `PRE_APPROVE`
decision_source	string	✓	`AUTO` / `MANUAL` / `PRE_APPROVAL_ENGINE`
approved_amount	string	✗	Fixed-point decimal; present on APPROVE / PRE_APPROVE
approved_interest_rate	string	✗	Decimal string; present on APPROVE / PRE_APPROVE
approved_term_months	int	✗	Present on APPROVE / PRE_APPROVE for term products
validity_period_days	int	✗	Present on APPROVE / PRE_APPROVE — offer expiry window
risk_rating	string	✓	Internal credit risk grade e.g. `A1`, `B2`
decline_reason_codes	array of string	✗	Present on DECLINE
model_version	string	✓
idempotency_key	string	✓

Consumers: MOD-007 (account state — gates account activation on APPROVE), MOD-063 (notification orchestration — decision notification to customer), MOD-033 (RWA engine — updates RWA on approval), MOD-048 (system decision log), MOD-059 (credit bureau submission engine — submits SUBMISSION record to bureau on APPROVE per FR-189)

`bank.credit.loan_account_opened`¶

Emitted by MOD-001 (via credit servicing) when a loan account is created in the ledger following credit approval and customer acceptance.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
application_id	uuid	✓
principal_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
term_months	integer	✓
interest_rate	string	✓	Decimal string
product_id	string	✓
jurisdiction	string	✓	`NZ` / `AU`
idempotency_key	string	✓

Consumers: MOD-030 (stage allocation model — initial IFRS 9 staging), MOD-031 (ECL calculation), MOD-033 (RWA engine), MOD-059 (credit bureau submission)

`bank.credit.loan_disbursed`¶

Emitted by MOD-065 (credit servicing) when a loan facility transitions to DISBURSED status and funds are credited to the customer account via MOD-001. Provides a dedicated disbursement signal distinct from facility_status_changed (which covers all loan status transitions). Required by MOD-026 (IFTI/CMIR trigger — large cash disbursements above threshold), MOD-016 (AML typology — large disbursement pattern), and MOD-042 (CDC for credit portfolio analytics).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
loan_account_id	uuid	✓
customer_id	uuid	✓
posting_id	uuid	✓	Credit-leg posting reference from MOD-001
disbursed_amount	string	✓	Fixed-point decimal — net disbursement after fees
principal_amount	string	✓	Fixed-point decimal — gross principal
currency	string	✓	ISO 4217
product_id	string	✓
product_type	string	✓	`PERSONAL_LOAN` / `CREDIT_LINE` / `OVERDRAFT` / `MORTGAGE` / `BUSINESS_LOAN`
disbursement_account_id	uuid	✓	Customer account receiving the credit
term_months	integer	✓
interest_rate	string	✓	Decimal string
first_repayment_date	date	✓	ISO 8601 date
jurisdiction	string	✓	`NZ` / `AU`
channel	string	✓	`APP` / `BRANCH` / `API`
idempotency_key	string	✓

Consumers: MOD-026 (IFTI/CMIR trigger — disbursements above reporting threshold), MOD-016 (AML typology — large disbursement monitoring), MOD-031 (ECL — marks facility as active for expected credit loss calculation), MOD-042 (CDC → Snowflake — credit portfolio analytics), MOD-063 (notification orchestration — disbursement confirmation to customer)

`bank.credit.repayment_received`¶

Emitted by MOD-001 after a scheduled or unscheduled loan repayment posting is committed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
posting_id	uuid	✓
repayment_amount	string	✓	Fixed-point decimal
principal_component	string	✓	Fixed-point decimal
interest_component	string	✓	Fixed-point decimal
outstanding_balance_after	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
repayment_type	string	✓	`SCHEDULED` / `UNSCHEDULED` / `EARLY_REPAYMENT`
idempotency_key	string	✓

Consumers: MOD-030 (stage allocation model), MOD-031 (ECL calculation), MOD-059 (credit bureau submission), MOD-065 (credit servicing & collections — clears arrears flag if applicable)

`bank.credit.arrears_triggered`¶

Emitted by MOD-065 when a loan account enters arrears following a missed payment.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
days_past_due	integer	✓
overdue_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
idempotency_key	string	✓

Consumers: MOD-030 (stage allocation model — triggers stage migration), MOD-031 (ECL calculation — recalculates provision), MOD-059 (credit bureau submission), MOD-063 (notification orchestration — hardship outreach), MOD-040 (churn & health score — financial stress signal)

`bank.credit.ecl_updated`¶

Emitted by MOD-031 after each ECL recalculation cycle. Three run types produce this event: MONTHLY (month-end full portfolio), DAILY_INCREMENTAL (overnight sweep), and EVENT_TRIGGERED (on bank.credit.stage_allocated). Consumed by the GL posting engine and the risk platform for capital reporting.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
trace_id	uuid	✓	ADR-031 trace propagation
ecl_run_id	uuid	✓	Links to `credit.ecl_runs(id)` for run-level audit
loan_account_id	uuid	✓
jurisdiction	string	✓	`"NZ"` / `"AU"` — needed by MOD-033 for capital framework selection
run_type	string	✓	`"MONTHLY"` / `"DAILY_INCREMENTAL"` / `"EVENT_TRIGGERED"` — lets consumers distinguish month-end snapshots from intraday updates
stage	integer	✓	`1`, `2`, or `3` (IFRS 9)
ecl_amount	string	✓	Fixed-point decimal
previous_ecl_amount	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
pd	string	✓	Probability of default decimal string
lgd	string	✓	Loss given default decimal string
ead	string	✓	Exposure at default decimal string
idempotency_key	string	✓

Consumers: MOD-001 (posting engine — GL provision entry), MOD-033 (RWA engine), MOD-036 (prudential return builder), MOD-042 (CDC → Snowflake)

`bank.credit.stage_allocated`¶

Emitted by MOD-030 after each IFRS 9 staging event (initial allocation, periodic reassessment, SICR trigger, or cure). Consumed by MOD-031 for ECL recalculation.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	uuid	✓	ADR-031 propagation
loan_account_id	uuid	✓
customer_id	uuid	✓	party_id
jurisdiction	string	✓	`"NZ"` / `"AU"`
ifrs9_stage	integer	✓	`1`, `2`, or `3`
previous_ifrs9_stage	integer		`1`, `2`, `3`, or null
trigger_reason	string	✓	Enum — see `credit.ifrs9_stage_allocations.trigger_reason`
arrears_days	integer	✓	≥0
exposure_at_default	string	✓	Fixed-point decimal
risk_rating	string		`"A1"`.."E"`or null — denormalised from`credit.credit_scores` (AD k-7)
effective_date	string	✓	YYYY-MM-DD
idempotency_key	string	✓

Consumers: MOD-031 (ECL trigger), MOD-033 (IRRBB/RWA capital engine), MOD-042 (CDC — Snowflake analytics)

`bank.credit.application_accepted`¶

Emitted by MOD-029 (accept-application handler) after the application status has transitioned to ACCEPTED (DB committed). Emission failure is non-fatal — the handler logs accept.event_publish_failed and still returns success to the client. Added as part of the MOD-162 build (k-10); MOD-029 patch is backwards-compatible.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
application_id	uuid	✓
customer_id	uuid	✓	aka party_id
approved_amount	string	✓	Decimal-as-string
currency	string	✓
jurisdiction	string	✓	`"NZ"` / `"AU"`
product_type	string	✓	`PERSONAL_LOAN` / `CREDIT_LINE` / `OVERDRAFT` / `MORTGAGE` / `BUSINESS_LOAN` / `FLEXIBLE_FACILITY`
idempotency_key	string	✓	Recommended key: `mod029:application-accepted:{application_id}`
trace_id	uuid		ADR-031 propagation

Consumers: MOD-065 (loan account provisioning for standard products), MOD-162 (filters on product_type='FLEXIBLE_FACILITY' to create facility envelope)

`bank.credit.facility_status_changed`¶

Emitted by MOD-065 on every loan status transition (disbursement, arrears escalation, default, write-off, payoff).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
previous_loan_status	string	✓	Enum — see `credit.loan_accounts.loan_status`
new_loan_status	string	✓	Enum
arrears_days	integer	✓
idempotency_key	string	✓

Consumers: MOD-030 (stage allocation — arrears_triggered), MOD-031 (ECL recalculation), MOD-059 (CCR submission on DEFAULT — follow-on), MOD-022 (audit)

`bank.credit.hardship_declared`¶

Emitted by MOD-065 when a customer invokes their hardship rights.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
case_id	uuid	✓
channel	string	✓	`APP` / `BRANCH` / `API` / `EMAIL`
idempotency_key	string	✓

Consumers: MOD-063 (customer notification), MOD-022 (audit)

`bank.credit.hardship_resolved`¶

Emitted by MOD-065 when a hardship case is closed with an outcome.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
case_id	uuid	✓
outcome	string	✓	`UPHELD` / `REJECTED`
restructure_type	string		Nullable — `PAYMENT_PAUSE` / `REDUCED_AMOUNT` / `TERM_EXTENSION` / `INTEREST_RATE_FREEZE`
idempotency_key	string	✓

Consumers: MOD-063 (customer notification), MOD-022 (audit), MOD-031 (provisioning adjustment for restructured loans)

`bank.credit.collateral_registered`¶

Emitted by MOD-066 when a new security interest is registered against a credit facility.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
jurisdiction	string	✓	`NZ` or `AU`
collateral_type	string	✓	`REAL_PROPERTY` / `VEHICLE` / `TERM_DEPOSIT` / `GUARANTEE` / `BUSINESS_ASSETS` / `OTHER`
security_interest_type	string	✓
net_collateral_value	string	✓	Fixed-point decimal
currency	string	✓	ISO 4217
ltv_ratio	string	✗	Nullable — present when outstanding principal known
ltv_breach	boolean	✓
registration_expiry_date	string	✗	ISO date; nullable
idempotency_key	string	✓

Consumers: MOD-115 (LVR monitoring), MOD-033 (RWA), MOD-076 (compliance alerting)

`bank.credit.collateral_revalued`¶

Emitted by MOD-066 after each valuation record is committed. Carries both previous and current LTV breach state so consumers can derive cure without a separate event.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
valuation_id	uuid	✓	FK to `credit.collateral_valuations.id`
estimated_value	string	✓	Fixed-point decimal
net_collateral_value	string	✓	Fixed-point decimal
currency	string	✓
ltv_ratio	string	✗	Nullable
previous_ltv_breach	boolean	✓	State before this revaluation
ltv_breach	boolean	✓	State after this revaluation; cure = previous true, current false
model_version	string	✓
idempotency_key	string	✓

Consumers: MOD-115 (LVR monitoring), MOD-033 (RWA), MOD-031 (ECL provisioning)

`bank.credit.collateral_ltv_breached`¶

Emitted by MOD-066 only on ltv_breach false → true transitions. Cure detection is via the previous_ltv_breach / ltv_breach fields on bank.credit.collateral_revalued.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
ltv_ratio	string	✓	Fixed-point decimal — the breaching ratio
product_policy_max_ltv	string	✓	The policy cap that was exceeded
jurisdiction	string	✓
idempotency_key	string	✓

Consumers: MOD-115 (LVR monitoring), MOD-033 (RWA), MOD-076 (compliance alerting)

`bank.credit.collateral_released`¶

Emitted by MOD-066 on APPROVED release decision (not on REJECTED). Carries full governance trail for FR-200 audit.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
release_request_id	uuid	✓	FK to `credit.collateral_release_requests.id`
approval_committee_ref	string	✓	Governance ticket reference
approved_by_staff_id	string	✓
idempotency_key	string	✓

Consumers: MOD-115 (LVR monitoring), MOD-033 (RWA), MOD-031 (ECL provisioning)

`bank.credit.collateral_renewal_due`¶

Emitted by MOD-066 daily-expiry-sweep Lambda at the 90/30/7 day windows ahead of registration expiry.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
task_id	uuid	✓	FK to `credit.collateral_renewal_tasks.id`
days_until_expiry	int	✓	90, 30, or 7
registration_authority	string	✗	Nullable
registration_reference	string	✗	Nullable
registration_expiry_date	string	✓	ISO date
idempotency_key	string	✓

Consumers: MOD-076 (compliance alerting)

`bank.credit.collateral_writeoff_violation`¶

Emitted by MOD-066 consume-facility-status Lambda when a bank.credit.facility_status_changed event shows WRITE_OFF_PENDING for a loan that has active collateral with no APPROVED release request. Detection-only in v1 (FR-200 v1 alarm); prevention gate is MOD-065 follow-on.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓	Required for MOD-076 on-call actionability
collateral_id	uuid	✓
release_request_id	uuid	✗	Present if PENDING release request exists; null otherwise
collateral_status	string	✓
attempted_loan_status	string	✓	`WRITE_OFF_PENDING`
jurisdiction	string	✓
idempotency_key	string	✓

Consumers: MOD-076 (compliance alerting — fires SNS alert to on-call)

`bank.credit.property_security_registered`¶

Emitted by MOD-115 when a property security instrument is registered against a mortgage at settlement (FR-521). Distinct from bank.credit.collateral_registered (MOD-066, which handles all collateral types via the staff-facing back-office flow) — this event is the customer-drawdown-path registration triggered by MOD-116.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓	FK to `credit.collateral_register.id` (MOD-066 row)
loan_account_id	uuid	✓
customer_id	uuid	✓
jurisdiction	string	✓	`NZ` or `AU`
property_subtype	string	✓	`RESIDENTIAL` / `RURAL_RESIDENTIAL` / `APARTMENT` / `TOWNHOUSE`
borrower_intent	string	✓	`OWNER_OCCUPIER` or `INVESTOR`
title_reference	string	✓	LINZ / LRS title reference
lvr_pct	string	✓	Fixed-point decimal — LVR at registration
policy_max_lvr	string	✓	Fixed-point decimal
policy_breach	boolean	✓	Should be false at registration (FR-521 GATE blocks breaching registrations)
idempotency_key	string	✓

Consumers: MOD-033 (RWA), MOD-076 (compliance alerting)

`bank.credit.lvr_breach_detected`¶

Emitted by MOD-115 within 5 minutes of detecting that a loan's LVR has breached its policy maximum (FR-523). Emitted by both the daily-lvr-sweep Lambda (catch-up) and the consume-collateral-revalued Lambda (event-triggered, primary path for the 5-min SLA).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
collateral_id	uuid	✓
customer_id	uuid	✓
snapshot_id	uuid	✓	FK to `credit.lvr_snapshots.id` for the breaching snapshot
lvr_pct	string	✓	Fixed-point decimal — the breaching ratio
policy_max_lvr	string	✓
lvr_band	string	✓	e.g. `80-90` or `>90`
borrower_intent	string	✓	`OWNER_OCCUPIER` or `INVESTOR`
jurisdiction	string	✓
idempotency_key	string	✓

Consumers: MOD-063 (customer notification), MOD-076 (compliance alerting), MOD-033 (RWA)

`bank.credit.security_discharged`¶

Emitted by MOD-115 when a property security instrument is discharged following full loan repayment (FR-524). The discharge is triggered by MOD-116's payoff handler, which posts the final repayment to MOD-001 and then calls MOD-115's discharge-property-security URL with the resulting posting_id as the idempotency key. Distinct from bank.credit.collateral_released (MOD-066 — staff-initiated committee-approval release flow).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
collateral_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
posting_id	uuid	✓	The final repayment posting from MOD-001; idempotency anchor for replay safety
title_reference	string	✓	LINZ / LRS title reference
jurisdiction	string	✓
idempotency_key	string	✓

Consumers: MOD-066 (collateral register status update), MOD-033 (RWA), MOD-031 (ECL provisioning), MOD-076 (compliance alerting)

`bank.credit.mortgage_rate_elected`¶

Emitted by MOD-116 (elect-rate Lambda) when a customer elects a rate type for their mortgage — either fixing for a new term or choosing to revert to variable. FR-525.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
rate_period_id	uuid	✓	Newly created `credit.mortgage_rate_periods` row
rate_type	string	✓	`FIXED` or `VARIABLE`
interest_rate	string	✓	Fixed-point decimal
fixed_term_months	int	✗	Present when `rate_type = 'FIXED'`
idempotency_key	string	✓

Consumers: MOD-033 (balance sheet rate re-pricing), MOD-076 (audit)

`bank.credit.mortgage_rate_expired`¶

Emitted by MOD-116 (daily-fixed-rate-sweep Lambda) when a fixed rate period reaches its end_date and the loan auto-reverts to variable. FR-525.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
expired_rate_period_id	uuid	✓	The `EXPIRING → EXPIRED` row
new_rate_period_id	uuid	✓	New VARIABLE period created on reversion
reverted_to_rate	string	✓	Fixed-point decimal (current variable rate)
idempotency_key	string	✓

Consumers: MOD-033 (rate re-pricing), MOD-076 (audit)

`bank.credit.fixed_rate_expiring`¶

Emitted by MOD-116 (daily-fixed-rate-sweep Lambda) when a fixed rate period crosses the 90, 60, or 30-day notification boundary. FR-525 disclosure obligations.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
rate_period_id	uuid	✓
days_remaining	int	✓	90, 60, or 30
end_date	date	✓	Fixed period expiry date
idempotency_key	string	✓	`loan_account_id + ':' + days_remaining + ':' + rate_period_id`

Consumers: MOD-076 (audit), MOD-063 (notification dispatch — when built)

`bank.credit.break_cost_disclosed`¶

Emitted by MOD-116 (request-break-cost-quote Lambda) when a break cost quote is calculated and disclosed to the customer. CON-005 audit record. FR-526.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
disclosure_id	uuid	✓	`credit.break_cost_disclosures.id`
break_cost_amount	string	✓	Fixed-point decimal
currency	string	✓	`NZD` or `AUD`
expires_at	ISO8601	✓	Quote validity window
idempotency_key	string	✓

Consumers: MOD-076 (audit / CON-005 compliance record)

`bank.credit.mortgage_discharged`¶

Emitted by MOD-116 (discharge-mortgage Lambda) after full discharge: final repayment posted to MOD-001, MOD-115 security released, and credit.loan_accounts.loan_status set to PAID_OFF. FR-527.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
final_posting_id	uuid	✓	MOD-001 `posting_type='PAYMENT'` final repayment posting
break_cost_included	boolean	✓	True if a fixed rate period was active at discharge
discharge_idempotency_key	string	✓	Customer-supplied discharge reference
idempotency_key	string	✓

Consumers: MOD-066 (audit — collateral register cross-check), MOD-031 (ECL — loan closed, provision reversal), MOD-076 (compliance alerting)

`bank.credit.mortgage_notification_dispatched`¶

Emitted by MOD-116 (daily-fixed-rate-sweep and consume-repayment-missed Lambdas) when a mortgage notification stub fires. In v1 audit-only mode, this event provides observability into MOD-063's pending work queue until the notification orchestration module ships. FR-525 / FR-528.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
loan_account_id	uuid	✓
customer_id	uuid	✓
notification_id	uuid	✓	`credit.mortgage_notifications.id`
notification_type	string	✓	See `mortgage_notifications.notification_type` CHECK
channel	string	✓	`STUB` in v1
idempotency_key	string	✓

Consumers: MOD-076 (observability — tracks v1 stub backlog for MOD-063 handover)

`bank.credit.overdraft_facility_created`¶

Emitted by MOD-117 create-facility Lambda when an overdraft facility is activated and the paired credit.loan_accounts row is created. FR-529.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
facility_id	uuid	✓	`credit.overdraft_facilities.facility_id`
account_id	uuid	✓	Linked SD01 transaction account
loan_account_id	uuid	✓	Paired `credit.loan_accounts` row (product_type='OVERDRAFT')
approved_limit	string	✓	Fixed-point decimal
interest_rate_pct	string	✓	Annual rate as decimal string
facility_fee	string	✓	Monthly fee as decimal string
currency	string	✓	ISO 4217
idempotency_key	string	✓

Consumers: MOD-031 (ECL — OVERDRAFT asset class now present in loan_accounts), MOD-059 (CCR — new credit exposure)

`bank.credit.overdraft_limit_changed`¶

Emitted by MOD-117 adjust-limit Lambda on any limit increase or reduction. FR-529.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
facility_id	uuid	✓
account_id	uuid	✓
loan_account_id	uuid	✓
old_limit	string	✓	Fixed-point decimal
new_limit	string	✓	Fixed-point decimal
change_reason	string	✓	`INCREASE` / `REDUCTION` / `REVIEW`
idempotency_key	string	✓

Consumers: MOD-031 (ECL — limit change affects EAD for revolving product), MOD-059 (CCR)

`bank.credit.overdraft_interest_charged`¶

Emitted by MOD-117 monthly-close Lambda after the aggregated monthly interest debit is posted to MOD-001. FR-530.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
facility_id	uuid	✓
account_id	uuid	✓
posting_id	uuid	✓	MOD-001 posting reference
period_start	string	✓	ISO date — first day of the billing month
period_end	string	✓	ISO date — last day of the billing month
total_interest	string	✓	Fixed-point decimal — sum of daily_interest for the period
accrual_days_count	int	✓	Number of days with a negative balance in the period
currency	string	✓	ISO 4217
idempotency_key	string	✓	`(facility_id, period_end)`

Consumers: MOD-076 (ops dashboard — monthly interest income), MOD-031 (EIR accrual confirmation)

`bank.credit.overdraft_fee_assessed`¶

Emitted by MOD-117 monthly-close Lambda. Covers both charge and waiver outcomes with a single event type. FR-531.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
facility_id	uuid	✓
account_id	uuid	✓
period_month	string	✓	`YYYY-MM`
fee_amount	string	✓	Fixed-point decimal; `"0.00"` when waived
waived	boolean	✓	True when balance was positive throughout the month and fee is waived
posting_id	uuid	✗	Present when waived=false; MOD-001 posting reference
currency	string	✓	ISO 4217
idempotency_key	string	✓	`(facility_id, period_month)`

Consumers: MOD-110 (fee waiver record — when waived=true), MOD-076 (ops dashboard)

`bank.credit.overdraft_hardship_flag`¶

Emitted by MOD-117 daily-accrual-sweep Lambda when consecutive_drawn_days reaches 60. FR-532. Triggers MOD-007 hardship flag and MOD-063 customer notification (both v1 stubs).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
facility_id	uuid	✓
account_id	uuid	✓
loan_account_id	uuid	✓
consecutive_drawn_days	int	✓	Value at threshold trigger (≥ 60)
flagged_at	ISO8601	✓
idempotency_key	string	✓	`(facility_id, flagged_at date)` — one event per day per facility at threshold

Consumers: MOD-007 (hardship flag — v1 stub), MOD-063 (customer notification — v1 stub), MOD-065 (collections — hardship escalation path)

`bank.credit.overdraft_unarranged_detected`¶

Emitted by MOD-117 when a negative balance is detected on an account with no active overdraft facility (timing edge case from payment settlement or fee debits).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
account_id	uuid	✓
negative_balance	string	✓	Fixed-point decimal (negative value)
detected_at	ISO8601	✓
idempotency_key	string	✓	`(account_id, detected_at date)`

Consumers: MOD-063 (immediate customer notification — v1 stub), MOD-076 (ops alerting — manual review queue)

`bank.credit.overdraft_facility_closed`¶

Emitted by MOD-117 when a facility is closed (balance repaid, limit zeroed, loan_accounts.loan_status set to PAID_OFF).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
facility_id	uuid	✓
account_id	uuid	✓
loan_account_id	uuid	✓
close_reason	string	✓	`CUSTOMER_REQUEST` / `BANK_INITIATED` / `ACCOUNT_CLOSED`
final_balance	string	✓	Fixed-point decimal at closure (should be `"0.00"`)
closed_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-031 (ECL — remove from active portfolio), MOD-059 (CCR — remove from credit exposure)

`bank.credit.construction_schedule_created`¶

Emitted by MOD-121 (create-schedule handler) when a new construction loan drawdown schedule is created and linked to an existing mortgage.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
trace_id	uuid	✓
schedule_id	uuid	✓
loan_account_id	uuid	✓
party_id	uuid	✓
total_facility	string	✓	Fixed-point decimal
construction_end_date	string	✓	ISO8601 date
tranche_count	int	✓	Number of tranches on the schedule
currency	string	✓	ISO 4217

Consumers: MOD-063 (customer notification — schedule confirmed)

`bank.credit.construction_milestone_certified`¶

Emitted by MOD-121 (certify-tranche handler) when a tranche milestone is certified by the valuer/certifier and the tranche transitions to certified status.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
trace_id	uuid	✓
schedule_id	uuid	✓
tranche_id	uuid	✓
tranche_number	int	✓
certifier_reference	string	✓
certification_date	string	✓	ISO8601 date
status	string	✓	`"certified"`

Consumers: MOD-063 (customer notification — milestone approved)

`bank.credit.construction_drawdown_posted`¶

Emitted by MOD-121 (request-drawdown handler) after MOD-001 PAYMENT posting succeeds and the tranche transitions to drawn status.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
trace_id	uuid	✓
schedule_id	uuid	✓
tranche_id	uuid	✓
drawdown_amount	string	✓	Fixed-point decimal
total_drawn	string	✓	Cumulative drawn after this posting
posting_id	uuid	✓	MOD-001 posting reference

Consumers: MOD-063 (customer notification — funds disbursed)

`bank.credit.construction_phase_completed`¶

Emitted by MOD-121 when the construction phase ends: either all tranches are drawn (all_tranches_drawn) or the construction_end_date is reached without full drawdown (construction_end_date_reached). Triggers amortisation setup in MOD-112.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
trace_id	uuid	✓
schedule_id	uuid	✓
total_drawn	string	✓	Fixed-point decimal — final drawn amount at completion
conversion_date	string	✓	ISO8601 date
trigger_reason	string	✓	`all_tranches_drawn` \| `construction_end_date_reached`

Consumers: MOD-112 (amortisation schedule setup — AD k-7), MOD-063 (customer notification — construction phase complete)

`bank.credit.loan_balance_updated`¶

Emitted by MOD-121 (request-drawdown handler) after each successful drawdown to notify downstream systems of the updated principal balance. This event is the interface contract between MOD-121 (publisher) and MOD-115 (consumer — consume-loan-balance-updated handler for LVR refresh; AD k-8).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
trace_id	uuid	✓
loan_account_id	uuid	✓
previous_balance	string	✓	Fixed-point decimal
new_balance	string	✓	Fixed-point decimal
reason	string	✓	`"construction_drawdown"`

Publisher: MOD-121 (construction drawdown engine) Consumers: MOD-115 (LVR refresh — consume-loan-balance-updated handler, already deployed)

`bank.credit.facility_created`¶

Emitted by MOD-162 (create-facility handler) when a Flexible Loan Facility is provisioned from an accepted credit decision.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
facility_id	uuid	✓
customer_id	uuid	✓
credit_decision_id	uuid	✓
application_id	uuid	✓
facility_limit	string	✓	Decimal-as-string
currency	string	✓
expiry_date	string	✓	ISO8601 date
jurisdiction	string	✓	`"NZ"` / `"AU"`
initial_floating_component_seq	int	✓
initial_loan_account_id	uuid	✓
status	string	✓	`"ACTIVE"`
trace_id	uuid	✓

Consumers: MOD-030 (IFRS 9 stage allocation), MOD-042 (CDC — Snowflake analytics)

`bank.credit.component_created`¶

Emitted by MOD-162 (create-component handler) when a new facility component is added. Carries component_type so downstream consumers can filter without joining (k-7 ruling).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
facility_id	uuid	✓
component_id	uuid	✓	`loan_facility_components.id`
component_seq	int	✓
component_type	string	✓	`"FIXED"` / `"FLOATING"`
loan_account_id	uuid	✓	Backing loan_accounts row
principal_amount	string	✓	Decimal-as-string
interest_rate	string	✓	Decimal-as-string
term_months	int	✓
start_date	string	✓	ISO8601 date
maturity_date	string	✓	ISO8601 date
amortisation_type	string	✓
trace_id	uuid	✓

Consumers: MOD-112 (amortisation schedule creation — filters on component_type='FIXED'), MOD-031 (EIR calculation), MOD-163 (break-cost setup — component matures)

`bank.credit.component_status_changed`¶

Emitted by MOD-162 (update-component-status, daily-maturity-sweep, reprice-floating handlers) on any status transition of a facility component.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
facility_id	uuid	✓
component_id	uuid	✓
component_seq	int	✓
loan_account_id	uuid	✓
old_status	string	✓
new_status	string	✓
trigger_reason	string	✓
remaining_principal	string	✓	Decimal-as-string
trace_id	uuid	✓

Consumers: MOD-030 (IFRS 9 stage re-allocation), MOD-042 (CDC)

`bank.credit.effective_rate_changed`¶

Emitted by MOD-162 whenever any component event causes the facility's blended effective interest rate to change (k-6 recompute).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
source	string	✓	`"bank.credit"`
facility_id	uuid	✓
customer_id	uuid	✓
previous_effective_rate	string	✓	Decimal-as-string
new_effective_rate	string	✓	Decimal-as-string
trigger_reason	string	✓
trace_id	uuid	✓

Consumers: MOD-031 (IFRS 9 EIR re-compute), MOD-113 (customer statements — when built)

`bank.credit.break_cost_acknowledged`¶

Emitted by MOD-163 (break-cost calculator) after a customer acknowledges a BINDING break-cost quote via MOD-050 and the calculation row transitions to status='ACKNOWLEDGED'.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	string	✓
break_cost_calculation_id	uuid	✓	FK `credit.break_cost_calculations.id`
loan_facility_id	uuid	✓
component_id	uuid	✓
party_id	string	✓
break_cost	string	✓	Signed decimal: positive = customer pays; negative = break benefit (k-7)
currency	string	✓	`"NZD"` \| `"AUD"`
outstanding_principal	string	✓
remaining_term_months	int	✓
contracted_rate	string	✓
current_market_rate	string	✓
formula_version	string	✓	e.g. `"v1.0.0"` — for downstream consumers branching on formula evolution
valid_until	ISO8601	✓	MOD-065 MUST apply before this expires
acknowledged_at	ISO8601	✓
disclosure_acknowledgement_id	uuid	✓	MOD-050 disclosure id
idempotency_key	string	✓	`mod163:break-cost-acknowledged:{calculation_id}`
jurisdiction	string	✓	`"NZ"` \| `"AU"`

Consumers: MOD-065 (credit servicing & collections — prepayment processor; same bank-credit bus, no cross-bus grant needed). When break_cost < 0 (break benefit), MOD-065 posts the credit to the customer account via MOD-001 at prepayment time. MOD-132 (loan restructure & variation — variation-path break cost gate).

`bank.credit.loan_variation_requested`¶

Emitted by MOD-132 (loan restructure & variation workflow) when a customer submits a loan variation request. Triggers the materiality assessment path (MOD-029) and customer acknowledgement notification.

Bus: bank-credit · Source: bank.credit · Detail-type: loan_variation_requested

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	string	✓
variation_id	uuid	✓	FK `credit.loan_variations.id`
loan_account_id	uuid	✓
party_id	string	✓
variation_type	string	✓	One of `TERM_EXTENSION`, `RATE_TYPE_CHANGE`, `REPAYMENT_FREQUENCY_CHANGE`, `CAPITALISE_ARREARS`, `COMBINATION`
requires_assessment	boolean	✓	FR-589 materiality result — true for material variations
requires_break_cost	boolean	✓	True when variation involves early repayment or fixed-rate conversion
jurisdiction	string	✓	`"NZ"` \| `"AU"`
idempotency_key	string	✓	`mod132:variation-requested:{variation_id}`

Consumers: MOD-029 (credit decision engine — affordability re-assessment on material variations), MOD-053 (notification service — request acknowledgement to customer).

`bank.credit.loan_variation_confirmed`¶

Emitted by MOD-132 after all gates pass and the variation is confirmed — disclosure acknowledged, assessment passed (if required), break cost acknowledged (if applicable), and the variation is persisted as effective.

Bus: bank-credit · Source: bank.credit · Detail-type: loan_variation_confirmed

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	string	✓
variation_id	uuid	✓	FK `credit.loan_variations.id`
loan_account_id	uuid	✓
party_id	string	✓
variation_type	string	✓
before_terms	object	✓	Snapshot of prior rate, term, repayment frequency, repayment amount
after_terms	object	✓	Confirmed new terms
break_cost_calculation_id	uuid	○	Present when break cost was applicable; FK `credit.break_cost_calculations.id`
disclosure_acknowledgement_id	uuid	✓	MOD-050 disclosure acknowledgement id — CON-004 GATE evidence
confirmed_at	ISO8601	✓
jurisdiction	string	✓	`"NZ"` \| `"AU"`
idempotency_key	string	✓	`mod132:variation-confirmed:{variation_id}`

Consumers: MOD-112 (amortisation schedule engine — regenerate schedule via originate-schedule with generated_by='restructure'), MOD-050 (disclosure management — confirmation disclosure dispatch), MOD-053 (notification service — confirmation notification to customer).

`bank.credit.loan_variation_rejected`¶

Emitted by MOD-132 when a variation request is rejected — by the credit assessment engine, by the customer declining the disclosed terms, or by a system validation failure.

Bus: bank-credit · Source: bank.credit · Detail-type: loan_variation_rejected

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
trace_id	string	✓
variation_id	uuid	✓	FK `credit.loan_variations.id`
loan_account_id	uuid	✓
party_id	string	✓
variation_type	string	✓
rejection_reason	string	✓	Human-readable reason description
rejected_by	string	✓	`"ASSESSMENT_FAILED"` \| `"CUSTOMER_DECLINED"` \| `"SYSTEM"`
rejected_at	ISO8601	✓
jurisdiction	string	✓	`"NZ"` \| `"AU"`
idempotency_key	string	✓	`mod132:variation-rejected:{variation_id}`

Consumers: MOD-053 (notification service — rejection notification to customer).

SD06 — Analytics & Risk (`bank-risk-platform` bus)¶

`bank.risk.capital_ratio_breach`¶

Emitted by MOD-033 (ALERT_CAPITAL_RATIO_BREACH Snowflake Alert, 5-minute poll) when any capital ratio falls below the regulatory minimum or internal management buffer in risk_capital.capital_config. MOD-033 is dbt + DCM only — no Lambda; the alert fires directly from Snowflake via BANK_SNS_INTEGRATION and publishes to the bank-risk-platform EventBridge bus.

Bus: bank-risk-platform · Source: bank.risk-platform · Detail-type: capital_ratio_breach

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
trace_id	uuid	✓
run_id	uuid	✓	Matches `risk_capital.capital_run_audit.run_id`
ratio_type	string	✓	`CET1` / `TIER1` / `TOTAL_CAPITAL`
jurisdiction	string	✓	`NZ` / `AU`
ratio_value	string	✓	Fixed-point decimal
regulatory_minimum	string	✓	Fixed-point decimal — from `risk_capital.capital_config`
internal_buffer	string	✓	Fixed-point decimal — from `risk_capital.capital_config`
breach_severity	string	✓	`regulatory_minimum` / `internal_buffer`
position_date	string	✓	`YYYY-MM-DD`
calculated_at	ISO8601	✓

Consumers: MOD-076 (alarm-intake — routes to CFO + CRO per FR-207), MOD-058 (breach notification engine)

Note: MOD-036 (prudential return builder) is an SD06 Snowflake-native module. It consumes RWA and capital ratio data by referencing MOD-033's output schema via dbt source() — not by subscribing to this event (ADR-046).

`bank.risk.liquidity_ratio_updated`¶

Emitted by MOD-032 after each LCR/NSFR calculation run.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
calculation_id	uuid	✓
lcr	string	✓	Percentage as decimal string
nsfr	string	✓	Percentage as decimal string
lcr_breach_flag	boolean	✓
nsfr_breach_flag	boolean	✓
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — Board/ALCO alert on breach)

Note: MOD-036 (prudential return builder) is an SD06 Snowflake-native module. It consumes LCR/NSFR data by referencing MOD-032's output schema via dbt source() — not by subscribing to this event (ADR-046).

`bank.risk.customer_risk_score_updated`¶

Emitted by MOD-039 when a customer's risk score is recalculated and the score or tier changes.

Bus: bank-risk-platform · Source: bank.risk-platform · Detail-type: customer_risk_score_updated

Subscribers read bus ARN and detail-type from SSM: /bank/{env}/risk-platform/risk-customer/event-source-name and /bank/{env}/risk-platform/risk-customer/event-detail-type.

Field	Type	Required	Notes
event_id	uuid	✓	Envelope field
event_time	ISO8601	✓	Envelope field — UTC
schema_version	string	✓
party_id	uuid	✓	Cross-domain stable identifier (SD02 `party.parties.id`)
composite_risk_score	float	✓	0–100 numeric score (risk scores are not money — float is correct here)
risk_tier	string	✓	`LOW` / `MEDIUM` / `HIGH` / `CRITICAL`
previous_risk_tier	string	✗	Omitted on first score
tier_changed	boolean	✓
score_version	string	✓	Model version identifier e.g. `"v1-abc123def456"`
triggering_event	string	✗	Cause of recalculation e.g. `"sanctions_hit"`
scored_at	ISO8601	✓	When the score was calculated — use as idempotency anchor with `party_id`
idempotency_key	string	✓	Subscriber deduplication key

Idempotency: Subscribers MUST be idempotent on (party_id, scored_at) — the EB publisher Lambda may republish rows if it crashes before advancing its cursor.

Consumers: MOD-010 (CDD tier assignment — may trigger tier upgrade), MOD-016 (typology engine — threshold adjustment), MOD-039 itself publishes; MOD-079 (decision publication service — write-back)

`bank.risk.fraud_alert_raised`¶

Emitted by MOD-023 (transaction fraud scorer) or MOD-055 (onboarding fraud scoring) when a fraud probability exceeds the configured alert threshold.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
trace_id	uuid	✓	ADR-031 propagation
alert_id	uuid	✓
alert_source	string	✓	`TRANSACTION_FRAUD` / `ONBOARDING_FRAUD`
entity_type	string	✓	`CUSTOMER` / `PAYMENT` / `APPLICATION`
entity_id	uuid	✓
fraud_score	string	✓	Decimal string `"0.00"`–`"1.00"`
action_taken	string	✓	`BLOCK` / `STEP_UP_AUTH` / `ALERT_ONLY`
idempotency_key	string	✓

Consumers: MOD-020 (pre-payment validation — blocks if action_taken is BLOCK), MOD-018 (alert case management), MOD-024 (device & session intelligence), MOD-063 (notification orchestration)

`bank.risk.irrbb_outlier_breach`¶

Emitted by MOD-035 (IRRBB model) when EVE sensitivity exceeds the BCBS supervisory outlier threshold (15% of Tier 1 capital) in any scenario. Published via Snowflake Alert → SNS → alert-publish Lambda → EventBridge.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
trace_id	string	✓
run_id	string	✓	MOD-035 IRRBB_RUNS row identifier
jurisdiction	string	✓	`NZ` / `AU`
scenario_code	string	✓	`PARALLEL_UP` / `PARALLEL_DOWN` / `STEEPENER` / `FLATTENER` / `SHORT_UP` / `SHORT_DOWN`
shock_basis	string	✓	`BCBS` / `RBNZ` / `APRA`
eve_change	string	✓	Decimal string — EVE delta under scenario
eve_change_pct_tier1	string	✓	Decimal string — e.g. `"0.17"` for 17%
tier1_capital	string	✓	Decimal string — snapshot at calc time
supervisory_threshold	string	✓	`"0.15"` (BCBS threshold)
position_date	string	✓	ISO 8601 date
calculated_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-076 (observability & dashboards — ALCO/CRO escalation alert), MOD-036 (prudential returns builder — breach flag on regulatory submission)

`bank.risk.stress_test_completed`¶

Emitted by MOD-034 after a stress test scenario run completes.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
run_id	uuid	✓
scenario_name	string	✓	Human-readable scenario identifier
scenario_type	string	✓	`REGULATORY` / `INTERNAL` / `REVERSE`
cet1_post_stress	string	✓	Decimal string
lcr_post_stress	string	✓	Decimal string
passed	boolean	✓	True when all thresholds met
idempotency_key	string	✓

Consumers: MOD-036 (prudential return builder), MOD-048 (system decision log)

`bank.risk.customer_churn_at_risk_identified`¶

Emitted by MOD-040 once per customer per weekly scoring cycle when a customer transitions into the HIGH_CHURN segment (churn_probability_90d > 0.7) for the first time that week. Published by the outreach cron Lambda after reading V_CHURN_AT_RISK_NEW_ENTRIES.

Bus: bank-risk-platform · Source: bank.risk-platform · Detail-type: customer_churn_at_risk_identified

Subscribers read bus ARN and detail-type from SSM: /bank/{env}/risk-platform/churn/event-source-name and /bank/{env}/risk-platform/churn/outreach-lambda-arn.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
idempotency_key	string	✓
customer_id	uuid	✓
churn_probability_90d	string	✓	Fixed-point decimal string
churn_segment	string	✓	`HIGH_CHURN`
previous_segment	string	✓	Segment before this week's score
financial_health_score	string	✓	Fixed-point decimal string (0–100)
health_segment	string	✓	HEALTHY \| STRETCHED \| STRESSED
primary_churn_signal	string		Top contributing signal code
model_version	string	✓
scored_at	ISO8601	✓

Consumers: MOD-018 (case management — creates operations work queue task per FR-234), MOD-107 (NBA engine — proactive retention offer trigger)

`bank.risk-platform.market_rates_updated`¶

Emitted by MOD-085 after each market-rates ingestion and normalisation run. Published on the bank-risk-platform EventBridge bus.

Field	Type	Required	Notes
trace_id	string	✓
refresh_id	uuid	✓	Unique ID for this ingestion run
refresh_type	string	✓	`SCHEDULED` / `MANUAL`
provider_id	string	✓	Source provider identifier
pairs_updated	array	✓	List of currency pair / curve identifiers refreshed
event_time	ISO8601	✓

Consumers: MOD-025 (rate lock — SD04), MOD-071 (payment validation — SD04)

Note: This event is the ADR-047 confirmation event — it signals that the MOD-085 write-back Lambda has successfully written fresh reference data to SD04 Postgres. SD04 operational modules subscribe to this event to invalidate caches and trigger downstream processing. MOD-032, MOD-035, and MOD-086 are SD06 Snowflake-native modules — they consume market rate data by referencing the market.* schema directly via dbt source() and must not subscribe to this event (ADR-046 § 5).

`bank.risk-platform.data_quality_run_failed`¶

Emitted by MOD-038 when a dbt test run exits non-zero — i.e. at least one gated dataset scores below the configured quality threshold. Published on the bank-risk-platform EventBridge bus for human alerting only. The downstream risk calculation halt is enforced by the Snowflake Task DAG dependency (Task exits non-zero → dependent Tasks do not start), not by this event.

Field	Type	Required	Notes
trace_id	string	✓
run_id	uuid	✓	Unique ID for this DQ run
failed_datasets	array	✓	List of dataset names that failed
quality_scores	object	✓	Map of dataset → score (e.g. `{"raw_cdc_core.postings": 0.962}`)
threshold	number	✓	Configured minimum quality score
reconciliation_breaks	integer	✓	Count of open reconciliation breaks this run
event_time	ISO8601	✓

Consumers: MOD-076 (observability platform — alerts data engineering team)

Note: This event is a human notification. It is not a machine gate. SD06 modules (MOD-032/033/035/036) must not subscribe to this event to decide whether to run — their execution is blocked by the Task DAG dependency on MOD-038's Task completing successfully.

`bank.risk-platform.unattributed_cost_threshold_exceeded`¶

Emitted by MOD-098 when the daily unattributed cost share exceeds the configured threshold. Triggers ops alert via MOD-076.

Field	Type	Required	Notes
trace_id	string	✓
alert_id	uuid	✓
cost_date	string	✓	ISO 8601 date, e.g. `2026-04-30`
total_aws_cost_usd	number	✓	Total AWS cost for the day
unattributed_cost_usd	number	✓	Cost not attributable to a module
unattributed_share	number	✓	Fraction 0–1
threshold	number	✓	Configured threshold fraction
event_time	ISO8601	✓

Consumers: MOD-076 (observability platform — alarm fanout), ops team

`bank.transactions.categorised`¶

Emitted by MOD-041 for every transaction row newly visible in V_CATEGORISED_CURRENT since the last cursor position. The EB-publisher Lambda fires every minute (aligned with the 1-minute DT target_lag). Schema locked at v1.0 — JSON Schema at docs/event-schemas/bank.transactions.categorised.v1.schema.json in bank-risk-platform.

Bus: bank-risk-platform · Source: bank.risk-platform · Detail-type: transactions_categorised

Field	Type	Required	Notes
event_id	uuid	✓	Per-event UUID generated by publisher Lambda
event_time	ISO8601	✓	UTC — when the Lambda emitted the event
schema_version	string	✓	`"1.0"`
trace_id	string	✓	OpenTelemetry trace context (AWS_LAMBDA_REQUEST_ID)
idempotency_key	string	✓	SHA-256 hex of `posting_id\\|model_version` — consumers deduplicate on this; cursor-not-advanced retries produce identical keys
posting_id	string	✓	SD01 `accounts.postings.id` — the categorisation overlay key
customer_id	string	✓
jurisdiction	string	✓	`NZ` or `AU` — per scope ruling k-2; needed by MOD-033 and MOD-036 downstream
merchant_name	string\|null	✗	Normalised location name from `risk_customer.merchant_directory` (e.g. "Caltex – Parnell"); null when normaliser had no match
logo_url	uri\|null	✗	CDN-prefixed chain logo URL; publisher Lambda prefixes `/bank/{env}/risk-platform/merchant-assets/cdn-base-url` from SSM onto the relative path stored in the DT; null when directory entry has no logo
merchant_location_map_url	uri\|null	✗	CDN-prefixed per-location static map URL; location-level (Caltex Parnell ≠ Caltex Takapuna per scope ruling k-4); null for non-card transactions or unlisted locations
mcc	string\|null	✗	ISO 18245 4-digit MCC; from SD04 payment record or directory match; null when neither source has it
category_l1	string	✓	Top-level spend category (e.g. `GROCERIES`, `TRANSPORT`); `OTHER` when model confidence < 0.60
category_l2	string\|null	✗	Sub-category (e.g. `SUPERMARKET`, `FUEL`); null when category_l1 is `OTHER` or below L2 threshold
categorisation_confidence	string	✓	Decimal-string in [0.0000, 1.0000] (e.g. `"0.9234"`) — serialised as string to preserve precision; backed by `NUMBER(5,4)` in the DT
model_version	string	✓	Champion model version, format `v<YYYY-MM-DD>-<6-char-hash>`

Consumers: MOD-042 → SD08 dashboard insight feed (FR-240 spend-by-category refresh); MOD-042 → SD01 enrichment write-back (FR-238 — populates merchant_canonical, merchant_logo_id, category on the source posting in Postgres); MOD-070 (transaction history — cross-bus subscriber; updates enrichment columns on app.transaction_view rows matching posting_id)

Note: Amount is intentionally absent — money is the source-of-truth in SD01 accounts.postings. Consumers that need the transaction amount look it up via posting_id.

`bank.statutory.report_produced`¶

Emitted by MOD-080 after a successful period-close run: trial balance, IFRS statements, and S3 archive all complete. Published on the bank-risk-platform bus.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
period_id	string	✓	References `statutory.reporting_periods`
period_type	string	✓	`MONTHLY` / `QUARTERLY` / `ANNUAL`
period_end_date	string	✓	ISO date
report_types_produced	array	✓	e.g. `["TRIAL_BALANCE","P&L","BALANCE_SHEET","CASH_FLOW"]`
s3_archive_path	string	✓	S3 URI of the archived report package
trial_balance_run_id	uuid	✓	FK to `statutory.report_runs.id` for lineage
gl_lines_count	int	✓	Number of GL lines in the trial balance
idempotency_key	string	✓

Consumers: MOD-036 (prudential return builder), MOD-037 (AML reporting)

`bank.statutory.reconciliation_variance_detected`¶

Emitted by MOD-080 reconciliation Lambda when Snowflake trial balance diverges from SD01 accounts.balance beyond the configured tolerance. Blocks the ERP push. Published on the bank-risk-platform bus.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
period_id	string	✓
total_variance_dollars	string	✓	Fixed-point decimal — aggregate absolute variance
gl_lines_with_variance_count	int	✓	Number of GL lines exceeding tolerance
max_variance_dollars	string	✓	Largest single-line variance
idempotency_key	string	✓

Consumers: MOD-076 (ops alerting)

`bank.regulatory.wiki_sync_completed`¶

Emitted by MOD-056 wiki-import Lambda after each successful sync from the bank-wiki AI context pages. Signals that the REGULATORY.WIKI_* tables in Snowflake are up to date with the latest compiled wiki output.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
sync_run_id	uuid	✓	FK to `regulatory.wiki_import_log.run_id`
policies_imported	int	✓	Total policy rows upserted
modules_imported	int	✓	Total module rows upserted
satisfaction_entries_imported	int	✓	Total `wiki_policy_satisfaction` rows upserted
synced_at	ISO8601	✓	Timestamp of the completed sync
idempotency_key	string	✓

Consumers: CCO compliance dashboard (Streamlit refresh trigger)

`bank.regulatory.obligation_deadline_approaching`¶

Emitted by MOD-056 deadline-alerter Lambda at 09:00 daily, one event per time-bound obligation within the configured alert window (default 90 days) with no compliance evidence recorded for the current obligation period.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
policy_code	string	✓	e.g. `"REP-006"`
policy_title	string	✓
risk_domain	string	✓	e.g. `"D08"`
due_date	string	✓	ISO date of the obligation deadline
days_until_due	int	✓	Calendar days remaining
has_evidence	boolean	✓	Always `false` when this event fires
idempotency_key	string	✓	Deduplication key: `(policy_code, due_date)`

Consumers: MOD-076 (ops alerting — SNS to CCO), CCO dashboard

Note: The DCM alert ALERT_OBLIGATION_DEADLINE_APPROACHING routes independently to MOD-076 SNS via SYSTEM$SEND_SNS_MESSAGE. This EB event is the structured machine-readable counterpart for non-alarm subscribers (same pattern as MOD-080's variance event vs alarm).

`bank.regulatory.policy_without_satisfaction`¶

Emitted by MOD-056 when the NFR-011 check (V_POLICIES_WITHOUT_SATISFACTION) finds any active wiki policy with zero satisfying module entries. NFR-011 threshold is zero — any row in this view is a compliance gap.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
policy_code	string	✓	The policy with no satisfying module
policy_title	string	✓
risk_domain	string	✓
jurisdiction	string	✓	`NZ` / `AU` / `NZ + AU` / `Global`
detected_at	ISO8601	✓	When the check ran
idempotency_key	string	✓	`(policy_code, detected_at date)` — one event per policy per day

Consumers: MOD-076 (ops alerting — critical gap notification to CCO and CTO)

`bank.risk-platform.model_register_entry_created`¶

Emitted by MOD-173 when a new model is added to RISK_MGMT.MODEL_REGISTER (initial registration). Provides visibility to compliance and governance consumers without polling.

Bus: bank-risk-platform · Source: bank.risk-platform · Detail-type: model_register_entry_created

Field	Type	Required	Notes
event_id	uuid	✓	Client-generated
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
model_id	string	✓	e.g. `MOD-028`
model_name	string	✓
model_type	string	✓	`CREDIT` \| `MARKET` \| `LIQUIDITY` \| `OPERATIONAL` \| `AML` \| `OTHER`
tier	integer	✓	1, 2, or 3
regulator	string	✓	`RBNZ` \| `APRA` \| `BOTH` \| `INTERNAL`
evidence_pack_complete	boolean	✓	True if all 10 DT-013 artefacts are present at registration time
idempotency_key	string	✓	`model_register_created:{model_id}`

Consumers: MOD-076 (alarm intake — new model registered), MOD-056 (compliance visibility — optional integration per yaml, v1 additive).

`bank.risk-platform.model_validation_due_soon`¶

Emitted by MOD-173 (DCM alert ALERT_VALIDATION_OVERDUE + EB publisher) once per overdue-or-imminently-due model per day. Feeds the compliance team's validation scheduling workflow.

Bus: bank-risk-platform · Source: bank.risk-platform · Detail-type: model_validation_due_soon

Field	Type	Required	Notes
event_id	uuid	✓	Client-generated
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
model_id	string	✓
model_name	string	✓
tier	integer	✓
validator_role	string	✗	Assigned validator if set
next_validation_due	string	✓	ISO 8601 date
days_overdue	integer	✓	Negative = days remaining; positive = days past due
evidence_pack_complete	boolean	✓
idempotency_key	string	✓	`model_validation_due:{model_id}:{due_date}`

Consumers: MOD-076 (alarm intake — overdue validation alert to risk team), MOD-056 (compliance visibility — optional).

SD07 — Data Platform (`bank-platform` bus)¶

`bank.platform.decision_published`¶

Emitted by MOD-079 after a Snowflake decision result is written back to the Neon operational database. Signals to consumers that a new decision is available to read.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
decision_id	uuid	✓	Matches the `decision_id` in the decision publication contract
entity_type	string	✓	`APPLICATION` / `CUSTOMER` / `PAYMENT`
entity_id	string	✓
decision_type	string	✓	e.g. `ONBOARDING` / `CREDIT` / `RISK_SCORE`
decision_status	string	✓	`ACCEPT` / `REFER` / `REJECT` / `HOLD` / `CLEAR`
target_table	string	✓	Neon schema.table where result was written
idempotency_key	string	✓

Consumers: MOD-062 (workflow orchestration — resumes paused workflows), MOD-010 (CDD tier assignment), MOD-028 (credit score), MOD-048 (system decision log)

`bank.platform.decision_applied`¶

Emitted by the consuming service after it reads a published decision and applies the operational state change. Provides end-to-end traceability.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
decision_id	uuid	✓
applied_by_module	string	✓	e.g. `MOD-010`
state_change	string	✓	Human-readable description of what changed
idempotency_key	string	✓

Consumers: MOD-048 (system decision log — audit trail), MOD-047 (agent action logger)

`bank.platform.notification_sent`¶

Emitted by MOD-063 after a customer or operator notification is dispatched.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
notification_id	uuid	✓
recipient_id	uuid	✓	customer_id or agent_id
channel	string	✓	`PUSH` / `SMS` / `EMAIL` / `IN_APP`
template_id	string	✓
causal_event_id	uuid	✗	Event that triggered this notification
idempotency_key	string	✓

Consumers: MOD-048 (system decision log), MOD-047 (agent action logger — for agent-directed notifications)

`bank.platform.notification_dispatched`¶

Emitted by MOD-063 after a campaign-level notification dispatch completes, when the inbound trigger event carried an external_trigger block identifying the requesting module. Enables upstream modules to close the loop on their advance-notice obligation (FR-574 / CON-005).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
trace_id	string	✓	Propagated from the inbound trigger event
notification_id	string	✓	MOD-063 internal dispatch identifier
dispatched_at	ISO8601	✓	Latest per-recipient send timestamp
recipient_count	number	✓	Total customers dispatched to (v1: always 1 per invocation)
external_trigger	object	✓	`{ module: string, proposal_id: string, ...string fields }` — verbatim from trigger event

Consumers: MOD-127 (product config panel — flips notification_confirmed_at from optimistic v1 timestamp to actual dispatch time; filter: detail.external_trigger.module = "MOD-127")

`bank.platform.workflow_step_completed`¶

Emitted by MOD-062 when a workflow step completes, enabling choreography-based workflow advancement.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
workflow_id	uuid	✓
workflow_type	string	✓	e.g. `ONBOARDING` / `KYC_REVIEW` / `CREDIT_APPLICATION`
step_name	string	✓
step_result	string	✓	`PASS` / `FAIL` / `REFER` / `SKIP`
next_step	string	✗	Omitted when workflow is terminal
idempotency_key	string	✓

Consumers: MOD-062 (itself — advances to next step), MOD-064 (operations work queue — creates task if REFER)

`bank.platform.secret_rotated`¶

Emitted by MOD-045 after a secret rotation event in AWS Secrets Manager completes successfully. Allows consumers to refresh cached credentials.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
secret_arn	string	✓	ARN — not the secret value
secret_name	string	✓	Logical name e.g. `bank-core/db-password`
rotation_reason	string	✓	`SCHEDULED` / `MANUAL` / `BREACH_RESPONSE`
idempotency_key	string	✓

Consumers: All modules that cache the affected credential (resolved at deployment by secret-name subscriptions in consumer Lambda event filters).

`bank.platform.usage_event`¶

Emitted by every platform module on each billable operation (API call, ML inference, Snowflake query, enrichment call, notification send, document store, CDC record, decision publication, login, KYC check, payment initiated). Normalised and routed to S3 Iceberg by MOD-097.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	semver, e.g. `1.0.0`
idempotency_key	string	✓
tenant_id	string	✓	Licensee ID for SaaS billing, or `self` for the bank's own customers
module_id	string	✓	Pattern `MOD-\d{3}` — emitting module
facility_id	string	✓	Pattern `SD\d{2}` — emitting system domain
event_type	string	✓	`API_CALL` / `ML_INFERENCE` / `SNOWFLAKE_QUERY` / `ENRICHMENT_CALL` / `NOTIFICATION_SEND` / `DOCUMENT_STORE` / `CDC_EVENT` / `DECISION_PUBLICATION` / `LOGIN` / `PAYMENT_INITIATED` / `KYC_CHECK`
quantity	number	✓	Count of billable units (≥ 0)
resource_unit_type	string	✓	`CALLS` / `INFERENCES` / `CREDITS` / `MB` / `RECORDS` / `WRITES` / `SENDS` / `LAMBDA_GB_SECONDS`
environment	string	✓	`local` / `dev` / `uat` / `prod`
resource_units	number	✗	Cost-unit count (e.g. Lambda GB-seconds, MB stored, Snowflake credits)
resource_id	string	✗	Opaque ID for the resource the event was emitted for (e.g. payment_id, document_id)
correlation_id	string	✗	Originating request/trace id — links back to source operation

Consumers: MOD-097 (normaliser Lambda — routes to S3 Iceberg), MOD-099 (usage and billing report — reads daily aggregate)

`bank.platform.transaction_enriched`¶

Emitted by MOD-087 (transaction enrichment engine) after each successful enrichment of a bank.core.posting_completed event. Only posting_type = 'PAYMENT' events are enriched — non-merchant posting types (ACCRUAL, FX_CONVERSION, ADJUSTMENT, REVERSAL, PROVISION) are silently skipped; no event is emitted for them. Carries the canonical merchant identity and geolocation. Consumed by the Expense Intelligence Platform modules and the customer app layer.

Field	Type	Required	Notes
event_id	uuid	✓	Unique event ID
event_time	ISO8601	✓	UTC
schema_version	string	✓	e.g. `"1.0.0"`
posting_id	uuid	✓	Source posting from `bank.core.posting_completed` — dedup key
party_id	uuid	✓	Customer party
account_id	uuid	✓	Account the posting was applied to
raw_merchant_name	string	✓	v1: `accounts.postings.narrative` (cross-schema SELECT); v2: dedicated field on `posting_completed` or external API input
canonical_merchant_name	string	✓	Normalised canonical merchant name
mcc	string	✗	ISO 18245 4-digit MCC; null when unknown
logo_url	string	✗	CDN URL for merchant logo; null in v1 (requires external API)
lat	number	✗	Merchant latitude; null when location unavailable (FR-763 conditional)
lng	number	✗	Merchant longitude; null when location unavailable
enrichment_source	string	✓	`DICTIONARY` \| `MCC_INFERENCE` \| `MANUAL`
trace_id	string	✓	ADR-031 trace propagation from originating posting_completed

Consumers: MOD-088 (expense classification engine), MOD-089 (geo-spatial processor), MOD-091 (receipt processor), MOD-077 (account dashboard — customer app layer).

SD08 — Customer App (`bank-app` bus)¶

`bank.app.session_created`¶

Emitted by MOD-068 when a customer successfully authenticates and a new session token is issued.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
session_id	uuid	✓
customer_id	uuid	✓
device_fingerprint_id	uuid	✓	Reference to MOD-068's `access.device_registry.id` — MOD-024 maintains a parallel fraud-grade store (`payments.device_intelligence`) keyed on the same `device_fingerprint_hash`
auth_method	string	✓	`BIOMETRIC` / `PIN` / `PASSWORD` / `MFA_SMS`
ip_region	string	✗	Coarse geolocation; never precise coordinates
idempotency_key	string	✓

Consumers: MOD-024 (device & session intelligence — anomaly detection), MOD-023 (transaction fraud scorer — session context), MOD-047 (agent action logger)

`bank.app.session_revoked`¶

Emitted by MOD-068 when a session is invalidated — on explicit logout, password change, fraud signal, or admin revocation.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
session_id	uuid	✓
customer_id	uuid	✓
revocation_reason	string	✓	`USER_LOGOUT` / `PASSWORD_CHANGE` / `FRAUD_SIGNAL` / `STEP_UP_FAILED` / `ADMIN_REVOKE` / `EXPIRED` / `CONCURRENT_SESSION_REPLACED`
device_id	uuid	✗	Present when revocation is device-specific
idempotency_key	string	✓

Consumers: MOD-024 (device & session intelligence — session termination), MOD-063 (notification orchestration — concurrent session alert per FR-343)

`bank.app.consent_granted`¶

Emitted by MOD-049 when a customer grants a new consent — either a simple purpose consent (privacy, marketing) or a full open banking consent arrangement.

Field	Type	Required	Notes
trace_id	uuid	✓
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓	Cross-domain customer identifier
consent_id	uuid	✓	Stable public consent reference
consent_type	string	✓	`PRIVACY_POLICY` / `MARKETING_EMAIL` / `MARKETING_SMS` / `OPEN_BANKING` / etc.
jurisdiction_profile	string	✗	Present for OB consents: `au_cdr` / `nz_payments_nz` / `generic_fapi2`
third_party_id	uuid	✗	Present for OB consents
expires_at	ISO8601	✗	Omitted for indefinite consents
idempotency_key	string	✓

Consumers: MOD-061 (Open Banking API gateway — activates consent enforcement), MOD-050 (disclosure enforcement linkage), MOD-012 (KYC audit trail)

`bank.app.consent_withdrawn`¶

Emitted by MOD-049 when a customer withdraws any consent (FR-316). Revocation propagates to dependent systems within 60 seconds via TTL cache invalidation.

Field	Type	Required	Notes
trace_id	uuid	✓
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓
consent_id	uuid	✓	References `app.ob_consents.consent_id` or `app.consents.id`
consent_type	string	✓
withdrawn_via	string	✓	`APP` / `API` / `STAFF`
idempotency_key	string	✓

Consumers: MOD-061 (Open Banking gateway — immediately blocks data access), MOD-063 (in-app notification to customer — when built; stop-gap: logged as notification_dispatch_pending in v1), MOD-012 (KYC audit trail)

`bank.app.consent_amended`¶

Emitted by MOD-049 when the scopes of an active open banking consent are changed.

Field	Type	Required	Notes
trace_id	uuid	✓
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓
consent_id	uuid	✓
changed_scopes	array of string	✓	Delta: scopes added or removed
idempotency_key	string	✓

Consumers: MOD-061 (Open Banking gateway — updates cached scope set)

`bank.app.consent_expired`¶

Emitted by MOD-049 consent expiry sweeper (hourly EventBridge rule, FR-315) when an open banking consent's expires_at is reached and the status is transitioned to expired.

Field	Type	Required
trace_id	uuid	✓
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓
consent_id	uuid	✓
idempotency_key	string	✓

Consumers: MOD-061 (Open Banking gateway — invalidates consent cache entry), MOD-063 (expiry notification to customer — when built)

`bank.app.disclosure_acknowledged`¶

Emitted by MOD-050 when a customer acknowledges a mandatory regulatory or product disclosure within the onboarding or product-change flow.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
disclosure_id	uuid	✓
customer_id	uuid	✓
disclosure_type	string	✓	`FSG` / `PDS` / `RATE_CHANGE` / `CREDIT_CONTRACT` / `TERMS_AND_CONDITIONS`
version	string	✓	Document version string
channel	string	✓	`APP` / `AGENT` / `EMAIL`
acknowledged_at	ISO8601	✓
idempotency_key	string	✓

Consumers: MOD-007 (account state machine — gates activation), MOD-062 (workflow orchestration), MOD-012 (KYC audit trail)

`bank.app.case_opened`¶

Emitted by MOD-053 (open-case handler) when a new app.cases row is created. Published on the bank-app EventBridge bus.

Field	Type	Required	Notes
case_id	uuid	✓	`app.cases.id`
case_reference	string	✓	`^CAS-[0-9]{4}-[0-9]{6}$`
party_id	uuid	✓
case_type	string	✓	`COMPLAINT` / `SERVICE_REQUEST` / `HARDSHIP` / `DISPUTE` / `FRAUD_REPORT` / `REGULATORY_ENQUIRY` / `INTERNAL_REVIEW` / `AML_REFER`
case_status	string	✓	Initial status at open
priority	string	✓	`LOW` / `MEDIUM` / `HIGH` / `URGENT`
channel	string	✓	`APP` / `WEB` / `PHONE` / `EMAIL` / `BRANCH` / `REGULATOR` / `SYSTEM`
jurisdiction	string	✓	`NZ` / `AU`
subject	string	✓	max 200 chars
sla_deadline	ISO8601 \| null	✗
vulnerability_flag	boolean	✗
related_account_id	uuid \| null	✗	cross-domain bare UUID
related_payment_id	uuid \| null	✗	cross-domain bare UUID
actor_user_id	uuid \| null	✗
actor_type	string	✓	`CUSTOMER` / `STAFF` / `SYSTEM` / `REGULATOR`
idempotency_key	string	✓
trace_id	string \| null	✗
effective_at	ISO8601	✓

Consumers: MOD-063 (FR-329 acknowledgement to customer), MOD-064 (work queue), MOD-074 (back-office 360 timeline)

`bank.app.case_status_changed`¶

Emitted by MOD-053 (update-case-status handler) on every case_status transition. Published on the bank-app EventBridge bus.

Field	Type	Required	Notes
case_id	uuid	✓
case_reference	string	✓	`^CAS-[0-9]{4}-[0-9]{6}$`
party_id	uuid	✓
previous_status	string	✓
new_status	string	✓
resolution_summary	string \| null	✗	Required when transitioning to RESOLVED
actor_user_id	uuid \| null	✗
actor_type	string	✓	`CUSTOMER` / `STAFF` / `SYSTEM` / `REGULATOR`
trace_id	string \| null	✗
effective_at	ISO8601	✓

Consumers: MOD-063 (customer status notification), MOD-074 (back-office timeline)

`bank.app.case_sla_at_risk`¶

Emitted by MOD-053 SLA sweeper (daily EventBridge scheduled rule) when a case is within 5 days of statutory deadline. FR-330 / CON-002 obligation. Published on the bank-app EventBridge bus.

Field	Type	Required	Notes
case_id	uuid	✓
case_reference	string	✓	`^CAS-[0-9]{4}-[0-9]{6}$`
party_id	uuid	✓
case_type	string	✓	Full enum — same as `case_opened`
jurisdiction	string	✓	`NZ` / `AU`
sla_deadline	ISO8601	✓
days_until_breach	integer	✓	0–5
assigned_to	string \| null	✗
team	string \| null	✗
effective_at	ISO8601	✓

Consumers: MOD-063 (complaints-manager notification)

`bank.app.case_resolved`¶

Emitted by MOD-053 when a case reaches RESOLVED or CLOSED status. Published on the bank-app EventBridge bus.

Field	Type	Required	Notes
case_id	uuid	✓
case_reference	string	✓	`^CAS-[0-9]{4}-[0-9]{6}$`
party_id	uuid	✓
case_type	string	✓	Full enum — same as `case_opened`
resolved_at	ISO8601	✓
resolution_summary	string	✓
escalated_to_external_scheme	boolean	✓	true if AFCA/FSCL referral made
regulatory_reference	string \| null	✗	External scheme reference
actor_user_id	uuid \| null	✗
effective_at	ISO8601	✓

Consumers: MOD-063 (customer notification), MOD-074, SD06 analytics

`bank.app.document_uploaded`¶

Emitted by MOD-073 (finalize-upload handler) after an upload is confirmed — S3 object exists, checksum verified, metadata row written. Published on the bank-app EventBridge bus.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
document_id	uuid	✓	`app.document_metadata.id`
party_id	uuid	✓	Customer the document belongs to
document_category	string	✓	e.g. `IDENTITY`, `STATEMENT`, `SUPPORTING_EVIDENCE`
document_type	string	✓	More specific type within category
s3_key	string	✓	S3 object key
actor_user_id	uuid	✓	Uploader identity
idempotency_key	string	✓
trace_id	uuid	✓	ADR-031 propagation
effective_at	ISO8601	✓

Consumers: MOD-009 (eIDV scan trigger — filters on document_category='IDENTITY'; cross-bus IAM grant via MOD-104), MOD-053 (case attachment)

`bank.app.document_retention_purged`¶

Emitted by MOD-073 (retention-sweeper Lambda, EventBridge hourly schedule) when a document is deleted from S3 and soft-deleted in metadata after passing retention_delete_at. Satisfies PRI-003 AUTO.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"v1"`
document_id	uuid	✓
party_id	uuid	✓
document_category	string	✓
s3_key	string	✓	Key of the deleted S3 object
retention_delete_at	string	✓	ISO8601 date — the retention date that triggered deletion
effective_at	ISO8601	✓

Consumers: SD06 compliance archive (analytics/audit trail of purged documents)

`bank.app.access_denied`¶

Emitted by MOD-052 (role-scoped data access enforcement library) on every enforce() call that results in one or more attributes being denied. Consumed by SIEM to satisfy NFR-023 (MTTD ≤ 5 minutes for anomalous access events).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
trace_id	uuid	✓	ADR-031 propagation
staff_id	uuid	✓	Requesting staff user_id
role	string	✓	Staff role at time of request
entity	string	✓	Entity path evaluated (e.g. `aml.alerts`)
denied_attributes	string[]	✓	Attributes blocked by enforcement
deny_reason	string	✓	`INSUFFICIENT_ROLE_SCOPE` or `RESTRICTED_COMPLIANCE_AND_LEGAL`
jurisdiction	string	✓	`NZ` or `AU`

Consumers: SIEM subscription on bank-app bus (NFR-023). Also mirrored to access.access_log (Postgres, ADR-048 Cat 1) which is the durable compliance record.

`bank.app.role_assigned`¶

Emitted by MOD-052 when a staff role assignment is committed via the admin endpoint. Propagation signal for FR-328 (60-second propagation SLA — warm Lambda cache TTL).

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
trace_id	uuid	✓
staff_id	uuid	✓	Staff member whose role was assigned
role	string	✓	Role assigned (`customer-facing`, `compliance`, `operations`, `senior`)
granted_by_staff_id	uuid	✓	Admin who made the assignment

Consumers: SIEM/observability. Lambdas do not subscribe — role propagation is via 60s TTL cache expiry (FR-328 satisfied).

`bank.app.role_revoked`¶

Emitted by MOD-052 when a staff role is revoked via the admin endpoint.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1"`
trace_id	uuid	✓
staff_id	uuid	✓	Staff member whose role was revoked
role	string	✓	Role revoked
revoked_by_staff_id	uuid	✓	Admin who revoked the role

Consumers: SIEM/observability. Lambdas do not subscribe — stale role cache expires within 60s (FR-328 satisfied). For emergency revocations requiring immediate effect, a Lambda restart clears the cache.

`bank.app.product_config_proposed`¶

Emitted by MOD-127 (propose-change Lambda) when a product configuration change proposal is created and enters the maker/checker workflow. FR-573 / GOV-007 audit anchor.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
proposal_id	uuid	✓	`app.product_config_proposals.id`
product_id	text	✓	e.g. `PRD-001`
jurisdiction	string	✓	`NZ` or `AU`
parameter_key	string	✓	e.g. `rate.lending.variable`
previous_value	string	✓	JSON-encoded before-state
proposed_value	string	✓	JSON-encoded proposed value
change_kind	string	✓	`FAVOURABLE` or `UNFAVOURABLE`
proposed_by	string	✓	Staff user ID
effective_date	string	✓	`YYYY-MM-DD`
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-047 (agent action audit), SIEM

`bank.app.product_config_reviewed`¶

Emitted by MOD-127 (review-change Lambda) when a proposal is approved or rejected by the second reviewer. FR-573 / GOV-007 audit anchor.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
proposal_id	uuid	✓
product_id	text	✓
jurisdiction	string	✓
parameter_key	string	✓
status	string	✓	`approved` or `rejected`
reviewed_by	string	✓	Staff user ID of reviewer (guaranteed ≠ proposed_by by DB CHECK)
review_comment	string	✗	Present on rejection
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-047 (agent action audit), SIEM

`bank.app.product_config_applied`¶

Emitted by MOD-127 (apply-due-proposals Lambda) when an approved proposal's effective_date has passed and the change is applied to app.product_parameters. FR-575 REP-002 AUTO mechanism. Published only after the Postgres write succeeds; EventBridge PutEvents failure leaves the proposal in approved status for next-day retry.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
proposal_id	uuid	✓
product_id	text	✓
jurisdiction	string	✓
parameter_key	string	✓
previous_value	string	✓	JSON-encoded value before this change
current_value	string	✓	JSON-encoded new live value
applied_at	ISO8601	✓	Timestamp the change was applied
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-110 (fee engine — refresh live fee schedule), MOD-050 (disclosure — refresh config version), MOD-113 (statement gen — when built)

`bank.app.product_config_superseded`¶

Emitted by MOD-127 (propose-change Lambda) when a new proposal supersedes an existing pending or under_review proposal for the same (product_id, jurisdiction, parameter_key). FR-573 GOV-006 audit trail.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
proposal_id	uuid	✓	The proposal being superseded
superseded_by	uuid	✓	The new proposal ID
product_id	text	✓
jurisdiction	string	✓
parameter_key	string	✓
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), SIEM

`bank.app.product_config_change_proposed_unfavourable`¶

Emitted by MOD-127 (propose-change Lambda) when a proposal is classified as unfavourable by classify-unfavourable.ts. This event crosses the bus boundary to bank-platform to trigger MOD-063 notification dispatch. FR-574 / CON-005 GATE trigger. Published in the same proposal creation flow as bank.app.product_config_proposed.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓	`"1.0.0"`
trace_id	uuid	✓
proposal_id	uuid	✓
product_id	text	✓
jurisdiction	string	✓
parameter_key	string	✓
change_kind	string	✓	`UNFAVOURABLE`
advance_days	int	✓	`advance_notice_days` from `app.product_parameter_metadata`
previous_value	string	✓	JSON-encoded before-state
proposed_value	string	✓	JSON-encoded proposed value
idempotency_key	string	✓

Consumers: MOD-002 (immutable transaction log), MOD-063 (notification orchestration — cross-bus via EventBridge rule on bank-platform bus; triggers advance-notice dispatch to affected customers)

`bank.app.profile_updated`¶

Emitted by MOD-072 (commit-profile-update Lambda) when a customer profile field is successfully committed. When re_verification_required = true, bank-kyc subscribes and re-triggers CDD. MOD-063 subscribes to refresh notification-preference cache. Published on the bank-app EventBridge bus.

Field	Type	Required	Notes
party_id	uuid	✓	Customer whose profile changed
fields_changed	array	✓	Each entry: `{field_path, previous_value_sha256, new_value_sha256, regulated}`
re_verification_required	boolean	✓	True when a regulated field (email, phone, residential_address) was changed
actor_type	string	✓	`CUSTOMER` or `STAFF`
actor_user_id	uuid	✓	`access.user_identities.user_id` of the actor
actor_justification	string		Required when actor_type = `STAFF`
session_id	uuid	✓	MOD-068 session that authorised the change
channel	string	✓	`APP`, `WEB`, `BACK_OFFICE`, or `API`
idempotency_key	uuid	✓	Unique per commit transaction
trace_id	uuid	✓	Distributed trace ID
effective_at	ISO8601	✓	Timestamp of the committed change

Consumers: bank-kyc (MOD-009/010 re-verification when re_verification_required=true; cross-bus — BankKycRole requires events:PutRule/PutTargets on bank-app bus via MOD-104), bank-app MOD-063 (notification routing refresh — intra-bus), bank-app statement modules (intra-bus)

Consumers: MOD-002 (immutable transaction log), MOD-063 (notification orchestration — cross-bus via EventBridge rule on bank-platform bus; triggers advance-notice dispatch to affected customers)

`bank.app.card_control_changed`¶

Emitted by MOD-078 on every successful card control action — freeze, unfreeze, limit change, or channel toggle. Intra-bus on bank-app. Consumed by MOD-063 to confirm the change to the customer via push notification within the FR-373 5 s SLA.

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓
schema_version	string	✓
party_id	uuid	✓
card_id	uuid	✓
control_type	string	✓	`FREEZE` / `UNFREEZE` / `LIMIT_SET` / `CHANNEL_TOGGLE` / `VIRTUAL_CARD`
prev_state	object	✓	Snapshot of control state before change
new_state	object	✓	Snapshot of control state after change
audit_id	uuid	✓	References `app.card_control_audit(id)`
idempotency_key	string	✓

Consumers: MOD-063 (notification orchestration — customer push confirmation)

`bank.app.automation_rule_fired`¶

Emitted by MOD-051 when a rule evaluation results in an action being taken or a significant outcome (condition passed, funds swept, notification sent). NOT emitted for no-op NOT_APPLICABLE evaluations. Consumed by MOD-063 for the FR-324 "notify within 60s" obligation.

Bus: bank-app · Source: bank.app · Detail-type: automation_rule_fired

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
rule_id	uuid	✓
execution_id	uuid	✓	`app.automation_rule_executions(execution_id)`
party_id	uuid	✓
rule_type	string	✓	e.g. `ROUND_UP` \| `SCHEDULED_TRANSFER`
action_outcome	string	✓	`EXECUTED` \| `NOTIFICATION_ONLY` \| `SKIPPED_INSUFFICIENT_FUNDS` \| `SKIPPED_RULE_PAUSED`
amount	string	✗	Fixed-point decimal; present when funds moved
currency	char(3)	✗	ISO 4217
source_account_id	uuid	✗
dest_account_id	uuid	✗
mod_020_payment_id	uuid	✗	Present when action_outcome = EXECUTED
idempotency_key	string	✓	Matches `app.automation_rule_executions.idempotency_key`
trace_id	uuid	✓

Consumers: MOD-063 (notification orchestration — FR-324 customer notification within 60s of rule action).

`bank.app.automation_rule_failed`¶

Emitted by MOD-051 when a rule evaluation or action fails with an error (distinct from SKIPPED_INSUFFICIENT_FUNDS which is an expected fail-soft outcome). Used for operational alerting on the low-balance safety-net fail path and unexpected MOD-020 errors.

Bus: bank-app · Source: bank.app · Detail-type: automation_rule_failed

Field	Type	Required	Notes
event_id	uuid	✓
event_time	ISO8601	✓	UTC
schema_version	string	✓	`"1.0.0"`
rule_id	uuid	✓
execution_id	uuid	✓
party_id	uuid	✓
rule_type	string	✓
failure_reason	string	✓	Human-readable failure description
action_outcome	string	✓	`FAILED` \| `MOD_020_DECLINED`
idempotency_key	string	✓
trace_id	uuid	✓

Consumers: MOD-063 (fail-soft notification to customer where relevant), MOD-076 (ops alerting — unexpected rule failures).

EventBridge domain event catalogue¶

SD01 — Core Banking (bank-core bus)¶

bank.core.posting_completed¶

bank.core.balance_updated¶

bank.core.account_status_changed¶

bank.core.interest_accrued¶

bank.core.accrual_run_completed¶

bank.core.accrual_correction_posted¶

bank.core.rate_change_proposed¶

bank.core.rate_change_approved¶

bank.core.rate_change_rejected¶

bank.core.rate_change_notified¶

bank.core.rate_change_activated¶

bank.core.dormancy_triggered¶

bank.core.fx_rate_received¶

bank.core.fx_conversion_completed¶

bank.core.fx_revaluation_completed¶

bank.core.fee_assessed¶

bank.core.fee_posted¶

bank.core.fee_reversed¶

bank.core.fee_waived¶

bank.core.trust_account_activated¶

bank.core.trustee_changed¶

bank.core.beneficial_owner_changed¶

bank.core.cdd_review_required¶

bank.core.cdd_review_completed¶

bank.core.community_account_activated¶

bank.core.community_signatory_changed¶

bank.core.community_signing_rule_changed¶

bank.core.community_authorisation_completed¶

bank.core.community_account_restricted_insufficient_signatories¶

bank.core.joint_account_activated¶

bank.core.joint_holder_changed¶

bank.core.joint_signing_authority_changed¶

bank.core.joint_share_adjusted¶

bank.core.joint_authorisation_completed¶

bank.core.joint_holder_death_recorded¶

bank.core.term_deposit_opened¶

bank.core.term_deposit_pre_maturity_notice¶

bank.core.term_deposit_instruction_captured¶

bank.core.term_deposit_break_cost_disclosed¶

bank.core.term_deposit_break_cost_accepted¶

bank.core.term_deposit_rolled_over¶

bank.core.term_deposit_proceeds_disbursed¶

bank.core.term_deposit_broken_early¶

bank.core.notice_lodged¶

bank.core.notice_pre_withdrawal_reminder¶

bank.core.notice_funds_available¶

bank.core.notice_early_withdrawal_disclosed¶

bank.core.notice_early_withdrawal_accepted¶

bank.core.notice_liquidity_snapshot¶

bank.core.obr_activated¶

bank.core.obr_resolved¶

bank.core.obr_state_verified¶

bank.core.amortisation_schedule_generated¶

bank.core.amortisation_schedule_recalculated¶

bank.core.amortisation_extra_repayment_options¶

bank.core.revolving_minimum_repayment_posted¶

bank.core.revolving_late_payment_assessed¶

bank.core.share_transaction_completed¶

bank.core.dividend_declared¶

bank.core.dividend_paid¶

bank.core.member_status_changed¶

bank.core.member_statement_due¶

bank.core.tax_certificate_due¶

SD02 — KYC Platform (bank-kyc bus)¶

bank.kyc.identity_verified¶

bank.kyc.identity_failed¶

bank.kyc.cdd_tier_assigned¶

bank.kyc.sanctions_match_found¶

bank.kyc.sanctions_match_cleared¶

bank.kyc.kyc_review_due¶

bank.kyc.kyc_review_completed¶

bank.kyc.kyc_review_overdue_block¶

bank.kyc.false_positive_recorded¶

bank.kyc.list_updated¶

bank.kyc.acceptance_decided¶

SD03 — AML Monitoring (bank-aml bus)¶

bank.aml.alert_raised¶

bank.aml.case_opened¶

SD01 — Core Banking (`bank-core` bus)¶

`bank.core.posting_completed`¶

`bank.core.balance_updated`¶

`bank.core.account_status_changed`¶

`bank.core.interest_accrued`¶

`bank.core.accrual_run_completed`¶

`bank.core.accrual_correction_posted`¶

`bank.core.rate_change_proposed`¶

`bank.core.rate_change_approved`¶

`bank.core.rate_change_rejected`¶

`bank.core.rate_change_notified`¶

`bank.core.rate_change_activated`¶

`bank.core.dormancy_triggered`¶

`bank.core.fx_rate_received`¶

`bank.core.fx_conversion_completed`¶

`bank.core.fx_revaluation_completed`¶

`bank.core.fee_assessed`¶

`bank.core.fee_posted`¶

`bank.core.fee_reversed`¶

`bank.core.fee_waived`¶

`bank.core.trust_account_activated`¶

`bank.core.trustee_changed`¶

`bank.core.beneficial_owner_changed`¶

`bank.core.cdd_review_required`¶

`bank.core.cdd_review_completed`¶

`bank.core.community_account_activated`¶

`bank.core.community_signatory_changed`¶

`bank.core.community_signing_rule_changed`¶

`bank.core.community_authorisation_completed`¶

`bank.core.community_account_restricted_insufficient_signatories`¶

`bank.core.joint_account_activated`¶

`bank.core.joint_holder_changed`¶

`bank.core.joint_signing_authority_changed`¶

`bank.core.joint_share_adjusted`¶

`bank.core.joint_authorisation_completed`¶

`bank.core.joint_holder_death_recorded`¶

`bank.core.term_deposit_opened`¶

`bank.core.term_deposit_pre_maturity_notice`¶

`bank.core.term_deposit_instruction_captured`¶

`bank.core.term_deposit_break_cost_disclosed`¶

`bank.core.term_deposit_break_cost_accepted`¶

`bank.core.term_deposit_rolled_over`¶

`bank.core.term_deposit_proceeds_disbursed`¶

`bank.core.term_deposit_broken_early`¶

`bank.core.notice_lodged`¶

`bank.core.notice_pre_withdrawal_reminder`¶

`bank.core.notice_funds_available`¶

`bank.core.notice_early_withdrawal_disclosed`¶

`bank.core.notice_early_withdrawal_accepted`¶

`bank.core.notice_liquidity_snapshot`¶

`bank.core.obr_activated`¶

`bank.core.obr_resolved`¶

`bank.core.obr_state_verified`¶

`bank.core.amortisation_schedule_generated`¶

`bank.core.amortisation_schedule_recalculated`¶

`bank.core.amortisation_extra_repayment_options`¶

`bank.core.revolving_minimum_repayment_posted`¶

`bank.core.revolving_late_payment_assessed`¶

`bank.core.share_transaction_completed`¶

`bank.core.dividend_declared`¶

`bank.core.dividend_paid`¶

`bank.core.member_status_changed`¶

`bank.core.member_statement_due`¶

`bank.core.tax_certificate_due`¶

SD02 — KYC Platform (`bank-kyc` bus)¶

`bank.kyc.identity_verified`¶

`bank.kyc.identity_failed`¶

`bank.kyc.cdd_tier_assigned`¶

`bank.kyc.sanctions_match_found`¶

`bank.kyc.sanctions_match_cleared`¶

`bank.kyc.kyc_review_due`¶

`bank.kyc.kyc_review_completed`¶

`bank.kyc.kyc_review_overdue_block`¶

`bank.kyc.false_positive_recorded`¶

`bank.kyc.list_updated`¶

`bank.kyc.acceptance_decided`¶

SD03 — AML Monitoring (`bank-aml` bus)¶

`bank.aml.alert_raised`¶

`bank.aml.case_opened`¶

`bank.aml.case_escalated`¶