{
 "name": "Key risk indicator (KRI) examples",
 "description": "40 KRIs across 10 risk areas, each with a definition, formula, data source, frequency, example Green/Amber/Red thresholds and, where one exists, the US rule or guidance behind it.",
 "page": "https://risktemplate.com/reference/key-risk-indicator-examples/",
 "csv": "https://risktemplate.com/reference/data/key-risk-indicator-examples.csv",
 "creator": "RiskTemplates (risktemplate.com)",
 "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
 "last_verified": "2026-10-14",
 "row_count": 40,
 "built_from": [
  "scripts/templates/kri_library_reference.json (snapshot of KRI_Library_Fintech_Edition.xlsx v2026.10.1)",
  "scripts/reference/kri_selection.json"
 ],
 "disclaimer": "Reference summary, not legal advice. Confirm obligations against the cited statute or rule and with counsel.",
 "thresholds_note": "Green/Amber/Red values are illustrative examples to calibrate against your own data and risk appetite, not regulatory requirements.",
 "rows": [
  {
   "id": "KRI-OR-001-1",
   "group": "operational",
   "group_label": "Operational",
   "risk_category": "Operational Risk",
   "name": "Transaction Error Rate",
   "description": "Percentage of transactions that fail, are reversed, or are manually corrected due to processing errors",
   "formula": "Error/reversal transactions / Total transactions × 100",
   "unit": "%",
   "frequency": "Daily",
   "green": "<0.1%",
   "amber": "0.1%–0.5%",
   "red": ">0.5%",
   "direction": "Lower is better",
   "rationale": "Error-free processing is the baseline expectation. <0.1% is a commonly cited target for straight-through processing — validate against your own data; >0.5% signals systematic processing issues requiring root cause analysis.",
   "data_source": "Payment processor logs: Stripe Dashboard > Payments > filter status=failed. Internal transaction database. Reconciliation system break log. Operations ticketing system for manual corrections.",
   "tier": "Operational",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-OR-008-1",
   "group": "operational",
   "group_label": "Operational",
   "risk_category": "Operational Risk",
   "name": "Regulatory Report Filing Timeliness",
   "description": "Percentage of mandatory regulatory reports filed by required deadline",
   "formula": "Reports filed on time / Total reports due in period × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "100%",
   "amber": "95%–<100%",
   "red": "<95%",
   "direction": "Higher is better",
   "rationale": "Late regulatory filings are a commonly cited exam finding, and repeat tardiness can lead to civil money penalties; 100% on time is the only acceptable target.",
   "data_source": "Regulatory reporting calendar (internal or from GRC tool). Include: OFAC/BSA/SAR deadlines, state license renewals, FinCEN reports, bank partner reporting deadlines, NMLS filings.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-OR-010-2",
   "group": "operational",
   "group_label": "Operational",
   "risk_category": "Operational Risk",
   "name": "Regulatory & Bank Partner Findings Past Due",
   "description": "Open findings from regulators, sponsor banks, card networks or auditors that are past the remediation date you committed to.",
   "formula": "Count of open external findings past committed remediation date",
   "unit": "count",
   "frequency": "Monthly",
   "green": "0",
   "amber": "1",
   "red": "≥2",
   "direction": "Zero tolerance",
   "rationale": "A missed commitment to a regulator or sponsor bank is treated as a governance failure, not just a late task. It is one of the fastest ways for a finding to escalate.",
   "data_source": "Issues tracker (e.g., the exam and regulatory findings log in the Issues Management Tracker)",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "Issues Management Tracker — Exam & Regulatory Findings",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TR-001-1",
   "group": "tech-bcp",
   "group_label": "Technology and business continuity",
   "risk_category": "Technology Risk",
   "name": "System Uptime / Availability",
   "description": "Percentage of time core payment and account systems are available to customers (excluding planned maintenance)",
   "formula": "(Total minutes in period - Unplanned downtime minutes) / Total minutes in period × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "≥99.9%",
   "amber": "99.5%–<99.9%",
   "red": "<99.5%",
   "direction": "Higher is better",
   "rationale": "99.9% ≈ 44 minutes of downtime a month; below 99.5% (≈3.6 hours a month) draws bank-partner scrutiny and customer churn. 99.9% is a common SLA level in bank-partner and SaaS agreements — use the level in your own contracts.",
   "data_source": "AWS CloudWatch or Datadog or PagerDuty — uptime monitoring. For customer-facing: StatusPage.io historical data. For payment processing: processor SLA reports (Stripe Dashboard > Developers > Webhooks).",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TR-001-2",
   "group": "tech-bcp",
   "group_label": "Technology and business continuity",
   "risk_category": "Technology Risk",
   "name": "Mean Time to Recovery (MTTR)",
   "description": "Average time from incident detection to full service restoration for P1/P2 incidents",
   "formula": "Sum of recovery times for P1/P2 incidents / Count of P1/P2 incidents",
   "unit": "hours",
   "frequency": "Monthly",
   "green": "<2 hours",
   "amber": "2–4 hours",
   "red": ">4 hours",
   "direction": "Lower is better",
   "rationale": "2 hours for P1/P2 recovery is a commonly cited target — validate against your own incident history and contract commitments. Longer recovery times signal gaps in runbooks, on-call processes, or architecture resilience.",
   "data_source": "PagerDuty, OpsGenie, or Jira Service Management — incident start time vs. all-clear time. Tag severity (P1/P2) consistently.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-OR-004-1",
   "group": "tech-bcp",
   "group_label": "Technology and business continuity",
   "risk_category": "Operational Risk",
   "name": "BCP Test Completion Rate",
   "description": "Percentage of business continuity plan tests completed as scheduled in the year",
   "formula": "BCP tests completed / BCP tests planned × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "100%",
   "amber": "80%–<100%",
   "red": "<80%",
   "direction": "Higher is better",
   "rationale": "The FFIEC Business Continuity Management booklet says an entity's risk profile should drive how often it exercises and tests its plans; it does not set a fixed minimum. Many bank partner agreements require at least annual testing, and an untested plan gives no evidence that recovery will work.",
   "data_source": "BCP documentation + test calendar. GRC tool (Vanta, Drata, Tugboat Logic) if implemented. Internal compliance project management (Jira, Asana).",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Examiners assess whether the exercise and testing program lets management confirm it can restore critical business functions; the entity's risk profile should drive how often it tests.",
   "hook_citation": "FFIEC IT Handbook, Business Continuity Management booklet, section VII.A",
   "hook_url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TR-012-1",
   "group": "tech-bcp",
   "group_label": "Technology and business continuity",
   "risk_category": "Technology Risk",
   "name": "DR Test Completion Rate",
   "description": "Percentage of disaster recovery and business continuity tests completed on schedule",
   "formula": "DR tests completed on schedule / DR tests planned in period × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "100%",
   "amber": "80%–<100%",
   "red": "<80%",
   "direction": "Higher is better",
   "rationale": "The FFIEC Business Continuity Management booklet expects documented, tested recovery plans; bank partners often require annual testing contractually. An untested plan cannot be relied on.",
   "data_source": "DR test schedule + test results documentation. BCP plan document. If using AWS: Elastic Disaster Recovery test failover results. Manual tracking in GRC tool (Vanta, Drata, Tugboat).",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "Examiners assess whether the exercise and testing program lets management confirm it can restore critical business functions; the entity's risk profile should drive how often it tests.",
   "hook_citation": "FFIEC IT Handbook, Business Continuity Management booklet, section VII.A",
   "hook_url": "https://ithandbook.ffiec.gov/it-booklets/business-continuity-management/",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-CY-003-1",
   "group": "cyber",
   "group_label": "Cybersecurity",
   "risk_category": "Cyber Risk",
   "name": "Phishing Click-Through Rate",
   "description": "Percentage of employees who click phishing links in simulated phishing tests",
   "formula": "Employees who clicked simulated phishing link / Employees who received test × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "<5%",
   "amber": "5%–15%",
   "red": ">15%",
   "direction": "Lower is better",
   "rationale": "Simulation vendors publish average click rates for their customer base — compare against your own vendor's data; <5% represents strong awareness; >15% indicates training program failure. Examiners and auditors review phishing results as evidence of awareness-training effectiveness.",
   "data_source": "Phishing simulation platform: KnowBe4, Proofpoint Security Awareness, Cofense. All three provide click rate reporting by department and campaign.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Non-bank financial institutions under the FTC must give personnel security awareness training updated for the risks in their risk assessment.",
   "hook_citation": "16 CFR 314.4(e)(1) (FTC Safeguards Rule)",
   "hook_url": "https://www.ecfr.gov/current/title-16/section-314.4",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-CY-001-2",
   "group": "cyber",
   "group_label": "Cybersecurity",
   "risk_category": "Cyber Risk",
   "name": "PII Records Exposed",
   "description": "Total number of customer PII records exposed in confirmed breach incidents in trailing 12 months",
   "formula": "Sum of PII records exposed across all confirmed breach incidents in the trailing 12 months",
   "unit": "count",
   "frequency": "Monthly",
   "green": "0",
   "amber": "1–999",
   "red": ">999",
   "direction": "Zero tolerance",
   "rationale": "State breach laws differ on when regulators or consumer reporting agencies must also be notified (commonly at 500 or 1,000 affected residents). Larger incidents widen notification duties and scrutiny from regulators and bank partners.",
   "data_source": "Incident investigation findings — forensic analysis of scope. Legal and compliance incident documentation. SIEM and DLP tool logs.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "A notification event involving the information of at least 500 consumers must be reported to the FTC no later than 30 days after discovery.",
   "hook_citation": "16 CFR 314.4(j)(1) (FTC Safeguards Rule)",
   "hook_url": "https://www.ecfr.gov/current/title-16/section-314.4",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-PR-007-1",
   "group": "cyber",
   "group_label": "Cybersecurity",
   "risk_category": "People Risk",
   "name": "Privileged Access Review Completion",
   "description": "Percentage of privileged access accounts (admin, root, service accounts) reviewed in quarterly access review",
   "formula": "Privileged accounts reviewed and certified / Total privileged accounts × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "100%",
   "amber": "95%–<100%",
   "red": "<95%",
   "direction": "Higher is better",
   "rationale": "SOC 2 criteria and bank-partner security standards expect periodic access reviews; 100% coverage is expected for privileged accounts, and any uncertified access is a finding.",
   "data_source": "Identity management system (Okta, AWS IAM, Azure AD) — pull list of privileged accounts. Access review tools: Vanta, Drata, SecureApp. Or manual spreadsheet certification.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Requires implementing and periodically reviewing access controls so only authorized users reach customer information.",
   "hook_citation": "16 CFR 314.4(c)(1) (FTC Safeguards Rule)",
   "hook_url": "https://www.ecfr.gov/current/title-16/section-314.4",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-PR-007-2",
   "group": "cyber",
   "group_label": "Cybersecurity",
   "risk_category": "People Risk",
   "name": "Terminated Employee Access Deprovisioning SLA",
   "description": "Percentage of terminated employees with access revoked within 24 hours of termination",
   "formula": "Terminated employees with access revoked within 24h / Total terminations × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "100%",
   "amber": "95%–<100%",
   "red": "<95%",
   "direction": "Higher is better",
   "rationale": "Same-day deprovisioning is a security baseline; any delay creates an insider-threat window. The FTC Safeguards Rule requires access controls that permit access only to authorized users (16 CFR 314.4(c)(1)), and auditors and bank partners test deprovisioning against your documented SLA.",
   "data_source": "Okta (or Azure AD/Google Workspace) — suspension timestamp vs. HR termination date. Cross-reference HR system termination date with IdP account status change.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Requires access controls that authenticate and permit access only to authorized users.",
   "hook_citation": "16 CFR 314.4(c)(1) (FTC Safeguards Rule)",
   "hook_url": "https://www.ecfr.gov/current/title-16/section-314.4",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TR-010-1",
   "group": "cyber",
   "group_label": "Cybersecurity",
   "risk_category": "Technology Risk",
   "name": "Critical Vulnerability Patch Time",
   "description": "Average days from disclosure of a critical-severity CVE to patch deployment in production",
   "formula": "Sum of days from CVE disclosure to patch deploy for critical CVEs / Count of critical CVEs patched in period",
   "unit": "days",
   "frequency": "Monthly",
   "green": "<7 days",
   "amber": "7–30 days",
   "red": ">30 days",
   "direction": "Lower is better",
   "rationale": "CISA's Binding Operational Directive 26-04 (June 10, 2026), which binds federal civilian agencies and replaced BOD 19-02's flat 15-day deadline for critical vulnerabilities, sets risk-based remediation timelines as short as 3 days for exposed, known-exploited vulnerabilities — a useful benchmark. The FTC Safeguards Rule requires continuous monitoring or vulnerability assessments at least every six months (16 CFR 314.4(d)(2)); >30 days creates an unacceptable exposure window.",
   "data_source": "Vulnerability scanner: Wiz, Snyk, Qualys, Tenable. GitHub Dependabot security alerts. CVE dates from NVD (nvd.nist.gov). Cross-reference with deployment logs.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Requires continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.",
   "hook_citation": "16 CFR 314.4(d)(2) (FTC Safeguards Rule)",
   "hook_url": "https://www.ecfr.gov/current/title-16/section-314.4",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TP-006-5",
   "group": "third-party",
   "group_label": "Third-party",
   "risk_category": "Vendor/Third-Party Risk",
   "name": "Critical Vendor Due Diligence Currency Rate",
   "description": "Percentage of critical/tier-1 vendors with due diligence assessments completed within the past 12 months",
   "formula": "Count of critical vendors with current (≤12M) due diligence / Total critical vendors × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "≥90%",
   "amber": "75%–<90%",
   "red": "<75%",
   "direction": "Higher is better",
   "rationale": "The 2023 interagency third-party guidance describes due diligence before selection and ongoing monitoring scaled to the risk and criticality of each relationship. A 12-month refresh for critical vendors is a common internal standard, not a regulatory deadline. ≥90% reflects good practice.",
   "data_source": "Vendor management system (Venminder, OneTrust, Prevalent, or GRC platform) — due diligence tracking module",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Describes due diligence before selecting a third party and ongoing monitoring scaled to the risk and criticality of the relationship.",
   "hook_citation": "Interagency Guidance on Third-Party Relationships, 88 FR 37920 (June 9, 2023), sections C.2 and C.4",
   "hook_url": "https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TP-005-2",
   "group": "third-party",
   "group_label": "Third-party",
   "risk_category": "Vendor/Third-Party Risk",
   "name": "Vendor SLA Breach Rate",
   "description": "Percentage of defined SLA metrics that vendors failed to meet in the reporting period",
   "formula": "Count of SLA metrics breached / Total SLA metrics tracked × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "<5%",
   "amber": "5%–10%",
   "red": ">10%",
   "direction": "Lower is better",
   "rationale": "SLA breaches signal operational degradation; >10% breach rate across critical vendor SLAs creates material operational risk and potential regulatory exposure for service disruptions.",
   "data_source": "Vendor contracts (SLA schedules); vendor-provided performance reports; internal monitoring dashboards (uptime, error rate, processing time)",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "Describes service-level agreements and performance measures used to monitor a third party and address poor performance.",
   "hook_citation": "Interagency Guidance on Third-Party Relationships, 88 FR 37920 (June 9, 2023), section C.3.b",
   "hook_url": "https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TP-006-1",
   "group": "third-party",
   "group_label": "Third-party",
   "risk_category": "Vendor/Third-Party Risk",
   "name": "Vendor SOC 2 Report Currency Rate",
   "description": "Percentage of critical/high-risk vendors with current SOC 2 Type II (or equivalent) reports on file (issued within past 12 months)",
   "formula": "Count of critical vendors with SOC 2 Type II report ≤12M old / Total critical vendors × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "≥85%",
   "amber": "70%–<85%",
   "red": "<70%",
   "direction": "Higher is better",
   "rationale": "SOC 2 Type II provides independent assurance over vendor controls. The 2023 interagency third-party guidance says a banking organization may consider reviewing SOC reports in due diligence, and bank partners commonly ask fintechs for current ones; gaps indicate unverified control environments for critical service providers.",
   "data_source": "Vendor management system — SOC 2 report repository; direct vendor requests; AICPA SOC 2 reports from vendors",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Says a banking organization may consider reviewing System and Organization Control (SOC) reports as part of due diligence.",
   "hook_citation": "Interagency Guidance on Third-Party Relationships, 88 FR 37920 (June 9, 2023), section C.2",
   "hook_url": "https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TP-012-1",
   "group": "third-party",
   "group_label": "Third-party",
   "risk_category": "Vendor/Third-Party Risk",
   "name": "Critical Vendor Exit Plan Coverage",
   "description": "Percentage of critical/tier-1 vendors for which a documented exit plan (vendor transition plan) exists and has been tested or reviewed in the past 12 months",
   "formula": "Count of critical vendors with current documented exit plans / Total critical vendors × 100",
   "unit": "%",
   "frequency": "Annual",
   "green": "≥80%",
   "amber": "60%–<80%",
   "red": "<60%",
   "direction": "Higher is better",
   "rationale": "The 2023 interagency third-party guidance describes contingency plans for transitioning an activity to another third party or bringing it in-house, and treats termination as a stage of every relationship. Without a plan, a critical vendor failure leaves no tested way out.",
   "data_source": "Vendor management system — exit plan repository; business continuity documentation; legal team (contract termination provisions)",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Describes contingency plans for moving an activity to another third party or in-house, and termination as a stage of the relationship.",
   "hook_citation": "Interagency Guidance on Third-Party Relationships, 88 FR 37920 (June 9, 2023), sections C.1 and C.5",
   "hook_url": "https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-AML-002-1",
   "group": "bsa-aml",
   "group_label": "BSA/AML",
   "risk_category": "BSA/AML Risk",
   "name": "CDD/EDD Completion Rate",
   "description": "Percentage of Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) reviews required in the period that were completed on time",
   "formula": "CDD/EDD reviews completed on schedule / Total CDD/EDD reviews due × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "≥95%",
   "amber": "85%–<95%",
   "red": "<85%",
   "direction": "Higher is better",
   "rationale": "CDD/EDD completion is a core BSA/AML expectation. FinCEN's CDD Rule requires risk-based procedures for ongoing customer due diligence, including maintaining and updating customer information on a risk basis. (FinCEN's 2018 CDD FAQs add that a routine periodic review is not by itself a trigger to update beneficial ownership information.) Reviews you schedule under your own policy are exam evidence, so missed reviews are a common finding.",
   "data_source": "CRM or AML platform (Actimize, NICE, Verafin, Fiserv) — CDD/EDD workflow module; manual tracking spreadsheet if no platform",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "Banks must have risk-based procedures for ongoing customer due diligence, including maintaining and updating customer information on a risk basis.",
   "hook_citation": "31 CFR 1020.210(a)(2)(v)",
   "hook_url": "https://www.ecfr.gov/current/title-31/section-1020.210",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-AML-003-1",
   "group": "bsa-aml",
   "group_label": "BSA/AML",
   "risk_category": "BSA/AML Risk",
   "name": "OFAC Screening Coverage Rate",
   "description": "Percentage of transactions and customer onboarding events screened against OFAC SDN and consolidated sanctions lists",
   "formula": "Screened transactions and onboarding events / Total transactions and onboarding events × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "100%",
   "amber": "99%–<100%",
   "red": "<99%",
   "direction": "Higher is better",
   "rationale": "OFAC's 2019 Framework for OFAC Compliance Commitments lists sanctions screening software or filter faults (for example, not updating to the latest SDN List) among the root causes of apparent violations. A screening gap is not itself a violation, but a prohibited transaction that passes through one can be, so treat this KRI as zero tolerance.",
   "data_source": "OFAC screening system (Refinitiv World-Check, LexisNexis, Accuity, ComplyAdvantage); transaction processing logs; onboarding platform screening logs",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Lists sanctions screening software or filter faults among the root causes of apparent sanctions violations.",
   "hook_citation": "OFAC, A Framework for OFAC Compliance Commitments (2019), section VI",
   "hook_url": "https://ofac.treasury.gov/media/16331/download?inline",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-AML-004-1",
   "group": "bsa-aml",
   "group_label": "BSA/AML",
   "risk_category": "BSA/AML Risk",
   "name": "SAR Filing Timeliness Rate",
   "description": "Percentage of Suspicious Activity Reports (SARs) filed with FinCEN within the 30-calendar-day regulatory deadline (60 days if no suspect identified)",
   "formula": "SARs filed within deadline / Total SARs filed in period × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "≥98%",
   "amber": "95%–<98%",
   "red": "<95%",
   "direction": "Higher is better",
   "rationale": "FinCEN requires SARs within 30 calendar days of initial detection of facts that may constitute a basis for filing (60 days if no suspect is identified). Late filings are a direct violation and a leading indicator in BSA enforcement actions.",
   "data_source": "FinCEN BSA E-Filing system; SAR case management system (Actimize, Verafin, internal tracker); SAR records (a copy of each SAR and its supporting documentation must be kept for 5 years under 31 CFR 1020.320(d))",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "A bank must file a SAR no later than 30 calendar days after initial detection of facts that may be a basis for filing (up to 60 days if no suspect is identified).",
   "hook_citation": "31 CFR 1020.320(b)(3)",
   "hook_url": "https://www.ecfr.gov/current/title-31/section-1020.320",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-AML-007-1",
   "group": "bsa-aml",
   "group_label": "BSA/AML",
   "risk_category": "BSA/AML Risk",
   "name": "Alert Aging Rate",
   "description": "Percentage of open transaction monitoring alerts that are more than 30 days old without disposition",
   "formula": "Open alerts aged >30 days / Total open alerts × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "<5%",
   "amber": "5%–15%",
   "red": ">15%",
   "direction": "Lower is better",
   "rationale": "Alert backlogs directly impact SAR filing timeliness and signal resource constraints. SARs are due 30 calendar days after initial detection, so an aged alert queue is a common sign of an under-resourced BSA program.",
   "data_source": "Transaction monitoring/case management system; AML platform alert queue with creation date timestamps",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Alert backlogs feed the SAR clock: a bank must file no later than 30 calendar days after initial detection.",
   "hook_citation": "31 CFR 1020.320(b)(3)",
   "hook_url": "https://www.ecfr.gov/current/title-31/section-1020.320",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-AML-009-1",
   "group": "bsa-aml",
   "group_label": "BSA/AML",
   "risk_category": "BSA/AML Risk",
   "name": "KYC Refresh Completion Rate",
   "description": "Percentage of customers requiring periodic KYC review (per risk-tiered schedule) who had their review completed on time in the period",
   "formula": "KYC reviews completed on time / KYC reviews due in period × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "≥95%",
   "amber": "85%–<95%",
   "red": "<85%",
   "direction": "Higher is better",
   "rationale": "Stale KYC creates undisclosed risk in the customer portfolio. FinCEN's CDD Rule expects customer information to be maintained and updated on a risk basis; FinCEN's 2018 CDD FAQs clarify only that a routine periodic review is not by itself a trigger to update beneficial ownership information. Once your policy sets refresh cycles by risk tier, examiners and bank partners test you against them. ≥95% on-time completion is a common internal target; backlog is a material BSA finding.",
   "data_source": "CRM or KYC platform; AML case management system; customer onboarding platform with KYC review scheduling (risk tier determines refresh frequency: High = annual, Medium = 2-year, Low = 3-year)",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "FinCEN CDD FAQs (FIN-2018-G001, Apr 3, 2018), Questions 13–14",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "Banks must have risk-based procedures for ongoing customer due diligence, including maintaining and updating customer information on a risk basis.",
   "hook_citation": "31 CFR 1020.210(a)(2)(v)",
   "hook_url": "https://www.ecfr.gov/current/title-31/section-1020.210",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-AML-006-1",
   "group": "bsa-aml",
   "group_label": "BSA/AML",
   "risk_category": "BSA/AML Risk",
   "name": "Alert-to-SAR Conversion Rate",
   "description": "Percentage of transaction monitoring alerts that ultimately result in a SAR filing, indicating alert quality and investigative effectiveness",
   "formula": "SARs filed in period / Total alerts closed (investigation complete) in period × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "2%–8%",
   "amber": "1%–<2% or >8%–15%",
   "red": "<1% or >15%",
   "direction": "Target range",
   "rationale": "Alert-to-SAR conversion is a common tuning signal: <1% suggests over-alerting or weak investigations; >15% suggests under-alerting. 2%–8% is a commonly cited range — validate against your own scenarios.",
   "data_source": "Transaction monitoring system (Actimize, Verafin, NICE, Fiserv); case management system; SAR filing records in FinCEN E-Filing",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-PM-001-1",
   "group": "compliance",
   "group_label": "Compliance",
   "risk_category": "Payments Risk",
   "name": "MTL License Coverage Rate",
   "description": "Percentage of states where the company has money transmission activity that are covered by an active money transmitter license",
   "formula": "States with active MTL where transmission occurs / States where money transmission activity occurs × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "100%",
   "amber": "90%–<100%",
   "red": "<90%",
   "direction": "Higher is better",
   "rationale": "Unlicensed money transmission can violate state law and federal law (18 U.S.C. § 1960). 100% coverage is required; any gap creates enforcement risk, and state penalties can accrue daily.",
   "data_source": "License management system (NMLS, Thomson Reuters GEMS, Wolters Kluwer ComplianceCentral) + transaction data showing active states. State licensing counsel review.",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "Makes it a federal crime to knowingly operate an unlicensed money transmitting business, including one run without a state license where the state makes that a misdemeanor or felony.",
   "hook_citation": "18 U.S.C. 1960",
   "hook_url": "https://www.law.cornell.edu/uscode/text/18/1960",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-CO-005-1",
   "group": "compliance",
   "group_label": "Compliance",
   "risk_category": "Compliance Risk",
   "name": "Privacy Rights Request Response Rate",
   "description": "Percentage of consumer data requests responded to within regulatory deadline",
   "formula": "Requests completed on time / Total requests × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "≥98%",
   "amber": "90%–<98%",
   "red": "<90%",
   "direction": "Higher is better",
   "rationale": "CCPA requires responses to consumer rights requests within 45 days (extendable once by 45 days with notice). Late responses trigger enforcement risk and consumer complaints.",
   "data_source": "Privacy request management system (OneTrust, TrustArc) or manual tracker",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-NB-002-1",
   "group": "compliance",
   "group_label": "Compliance",
   "risk_category": "Neobank/BaaS Risk",
   "name": "Reg E Error Resolution Timeliness",
   "description": "Percentage of Reg E electronic fund transfer error resolutions completed within required timeframes",
   "formula": "Reg E disputes resolved within statutory timeframe / Total Reg E disputes in period × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "100%",
   "amber": "95%–<100%",
   "red": "<95%",
   "direction": "Higher is better",
   "rationale": "Reg E requires provisional credit (or a determination) within 10 business days and final resolution within 45 calendar days (90 in some cases). EFTA allows actual damages plus statutory damages of $100–$1,000 per individual action, with class-action exposure; Reg E error resolution is a frequent exam focus.",
   "data_source": "Customer dispute management system (Zendesk, Salesforce Service Cloud, dedicated Reg E tracking tool) — dispute receipt date, provisional credit date, final resolution date. Bank partner dispute tracking.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "Sets the 10-business-day investigation period, provisional credit to extend it to 45 days, and the 20-business-day and 90-day extensions.",
   "hook_citation": "12 CFR 1005.11(c) (Regulation E)",
   "hook_url": "https://www.ecfr.gov/current/title-12/section-1005.11",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-OR-003-1",
   "group": "complaints",
   "group_label": "Consumer complaints",
   "risk_category": "Operational Risk",
   "name": "Customer Complaint Rate",
   "description": "Number of formal customer complaints per 1,000 active customers in the period",
   "formula": "Formal complaints received / Active customers × 1,000",
   "unit": "per 1K",
   "frequency": "Monthly",
   "green": "<2",
   "amber": "2–5",
   "red": ">5",
   "direction": "Lower is better",
   "rationale": "Complaint trends are reviewed by regulators and sponsor banks, and the CFPB's public complaint database makes spikes visible; >5 per 1K active customers is a red flag; complaint spikes often precede regulatory inquiries; monitoring enables proactive issue resolution",
   "data_source": "Support ticketing system (Zendesk, Intercom, Freshdesk) — formal complaints tagged separately from general support. CFPB complaint portal (if you have a consumer-facing product). Better Business Bureau complaints.",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-03",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-OR-003-2",
   "group": "complaints",
   "group_label": "Consumer complaints",
   "risk_category": "Operational Risk",
   "name": "Complaint Resolution Time (Average)",
   "description": "Average number of days from complaint receipt to final resolution",
   "formula": "Sum of days from complaint receipt to resolution / Total complaints resolved in period",
   "unit": "days",
   "frequency": "Monthly",
   "green": "<10 days",
   "amber": "10–30 days",
   "red": ">30 days",
   "direction": "Lower is better",
   "rationale": "Reg E requires provisional credit or a determination within 10 business days and final resolution within 45 calendar days (90 in some cases). Faster resolution reduces regulatory risk and improves customer experience; >30 days risks missing Reg E deadlines.",
   "data_source": "Support ticketing system (Zendesk) — complaint open date vs. resolution date. Reg E error resolution tracking if EFT product. CFPB complaint portal response tracking.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-03",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-CO-003-1",
   "group": "complaints",
   "group_label": "Consumer complaints",
   "risk_category": "Compliance Risk",
   "name": "UDAAP-Related Complaint Share",
   "description": "Percentage of complaints alleging misleading, unfair or undisclosed terms, fees or practices.",
   "formula": "Complaints tagged as alleging misleading/unfair/undisclosed terms or fees / Total complaints × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "<5%",
   "amber": "5%–10%",
   "red": ">10%",
   "direction": "Lower is better",
   "rationale": "Complaint themes, not just volume, are what point to UDAAP risk; the CFPB's public complaint database makes patterns visible to regulators and sponsor banks. Starter threshold — no reliable industry benchmark exists yet; recalibrate after 3 months of your own data.",
   "data_source": "Customer support platform (Zendesk, Intercom) + CFPB complaint database",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": true,
   "revised": "2026-10",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-BP-003-1",
   "group": "liquidity",
   "group_label": "Liquidity and funding",
   "risk_category": "Bank Partner Risk",
   "name": "Settlement Funding Buffer",
   "description": "Available liquidity as a multiple of peak daily settlement obligations",
   "formula": "Available cash / Peak daily settlement obligation in trailing 30 days",
   "unit": "ratio",
   "frequency": "Daily",
   "green": "≥3x",
   "amber": "2x–<3x",
   "red": "<2x",
   "direction": "Higher is better",
   "rationale": "Settlement funding failure is existential — a missed settlement can trigger a bank partner's suspension or termination rights; 3x buffer provides adequate cushion for unexpected volume spikes; <2x is dangerously thin",
   "data_source": "Treasury/banking system: available cash balance from bank account(s). Settlement obligation: daily ACH/wire settlement amounts from payment processor or bank partner. Can pull from both.",
   "tier": "Operational",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-SR-004-1",
   "group": "liquidity",
   "group_label": "Liquidity and funding",
   "risk_category": "Strategic Risk",
   "name": "Runway (Months of Cash)",
   "description": "Number of months of operating expenses covered by current cash reserves",
   "formula": "Current cash balance / Monthly operating burn rate",
   "unit": "months",
   "frequency": "Monthly",
   "green": "≥18 months",
   "amber": "9–<18 months",
   "red": "<9 months",
   "direction": "Higher is better",
   "rationale": "18 months is a commonly cited planning horizon for venture-backed fintechs; <12 months makes fundraising urgent; <9 months draws bank-partner concern (bank partners monitor the financial health of program managers).",
   "data_source": "Bank account balances (bank statements or Plaid connection) + accounting system for burn rate. Monthly burn = Total operating expenses per P&L.",
   "tier": "Board",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-FA-001-2",
   "group": "liquidity",
   "group_label": "Liquidity and funding",
   "risk_category": "Financial/Accounting Risk",
   "name": "Days of Operating Expenses (DOE)",
   "description": "Number of days of current operating expenses covered by cash and cash equivalents",
   "formula": "Cash and cash equivalents / (Annual operating expenses / 365)",
   "unit": "days",
   "frequency": "Monthly",
   "green": "≥180 days",
   "amber": "90–<180 days",
   "red": "<90 days",
   "direction": "Higher is better",
   "rationale": "180 days (about 6 months) is a commonly used planning floor; <90 days creates operational risk and bank-partner concern. Startup-phase companies may operate lower but should disclose it to their board and bank partner.",
   "data_source": "Bank account balance(s) from bank statements or accounting system + monthly burn rate from P&L. Same data as runway calculation.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-MR-004-1",
   "group": "model-ai",
   "group_label": "Model and AI",
   "risk_category": "Model Risk",
   "name": "Model Inventory Validation Coverage",
   "description": "Percentage of models in production that have been independently validated within required cycle",
   "formula": "Models with current independent validation / Total models in production × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "100%",
   "amber": "80%–<100%",
   "red": "<80%",
   "direction": "Higher is better",
   "rationale": "OCC Bulletin 2026-13 / SR 26-2 (which replaced SR 11-7) says validation generally occurs before a model's first use, with timing and frequency that vary with the model's purpose, methodology, changes and materiality. It is aimed at banking organizations with more than $30 billion in assets, and sponsor banks often apply it to fintech partners' models. <80% means material models lack validation.",
   "data_source": "Model inventory register (spreadsheet or GRC tool) with: model name, deployment date, last validation date, next due date, validator, status. Typically maintained by Model Risk Management or Compliance.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Revised interagency model risk guidance: validation generally occurs before first use, with timing and frequency that vary with the model. Aimed at banking organizations over $30 billion in assets; generative and agentic AI are out of scope.",
   "hook_citation": "OCC Bulletin 2026-13 / Federal Reserve SR 26-2 (April 17, 2026)",
   "hook_url": "https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-MR-004-4",
   "group": "model-ai",
   "group_label": "Model and AI",
   "risk_category": "Model Risk",
   "name": "Models Past Revalidation Date",
   "description": "Count of models in the model inventory that are overdue for their scheduled revalidation",
   "formula": "Count of models where Current Date > Scheduled Revalidation Date and revalidation not yet completed",
   "unit": "count",
   "frequency": "Monthly",
   "green": "0",
   "amber": "1–2",
   "red": ">2",
   "direction": "Zero tolerance",
   "rationale": "Any model past its revalidation date represents unreviewed model risk. Even 1-2 overdue models can signal resource or governance gaps. OCC Bulletin 2026-13 / SR 26-2 says validation generally occurs before first use; where a model must be used before validation is complete, it describes closer attention to the model's limitations and controls such as limits on its use. Document the interim controls for every overdue model.",
   "data_source": "Model inventory register with scheduled revalidation dates. Compare current date to revalidation due date for each model. Source: Model Risk Management tracking log.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "Where a model is used before validation is complete, the guidance describes closer attention to its limitations and controls such as limits on use.",
   "hook_citation": "OCC Bulletin 2026-13 / Federal Reserve SR 26-2 (April 17, 2026)",
   "hook_url": "https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-MR-004-2",
   "group": "model-ai",
   "group_label": "Model and AI",
   "risk_category": "AI & Automation Risk",
   "name": "AI Use Case Assessment Currency",
   "description": "Percentage of AI use cases in the inventory (in-house, vendor and GenAI) with a current, approved risk assessment.",
   "formula": "AI use cases with a current risk assessment / Total AI use cases in inventory × 100",
   "unit": "%",
   "frequency": "Quarterly",
   "green": "≥95%",
   "amber": "85%–<95%",
   "red": "<85%",
   "direction": "Higher is better",
   "rationale": "Bank partners and examiners start AI reviews with the inventory and ask whether each use case was assessed. OCC Bulletin 2026-13 / SR 26-2 covers predictive models but leaves generative and agentic AI out of scope, so the NIST AI RMF 1.0 and AI 600-1 fill the gap. California's CCPA automated-decision rules add risk-assessment duties for certain uses from 2026–27.",
   "data_source": "AI use case inventory (e.g., AI Risk Assessment Template)",
   "tier": "Board",
   "emerging": true,
   "source_anchor": "OCC Bulletin 2026-13 / SR 26-2; NIST AI RMF 1.0 and NIST AI 600-1; CCPA ADMT regulations",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-MR-004-3",
   "group": "model-ai",
   "group_label": "Model and AI",
   "risk_category": "AI & Automation Risk",
   "name": "Human Override Rate on AI Decisions",
   "description": "Percentage of AI recommendations (credit, fraud, KYC, collections) that human reviewers change.",
   "formula": "AI recommendations changed by a human reviewer / Total AI recommendations reviewed × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "2%–15%",
   "amber": "1%–<2% or >15%–25%",
   "red": "<1% or >25%",
   "direction": "Target range",
   "rationale": "Two-sided on purpose. Very low override rates suggest reviewers are rubber-stamping the model (automation bias); very high rates suggest the model is not fit for purpose. Human oversight is central to the NIST AI RMF and to model risk guidance. Starter threshold — no reliable industry benchmark exists yet; recalibrate after 3 months of your own data.",
   "data_source": "Decision engine logs with reviewer outcome",
   "tier": "Management",
   "emerging": true,
   "source_anchor": "NIST AI RMF 1.0 (human oversight); OCC Bulletin 2026-13 / SR 26-2",
   "starter_threshold": true,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-TP-006-2",
   "group": "model-ai",
   "group_label": "Model and AI",
   "risk_category": "AI & Automation Risk",
   "name": "Shadow AI Discoveries",
   "description": "New unapproved AI tools or AI uses discovered in the quarter through network/CASB monitoring, expense reviews, surveys or amnesty programs.",
   "formula": "Count of new unapproved AI tools or uses discovered in the period",
   "unit": "count",
   "frequency": "Quarterly",
   "green": "≤2",
   "amber": "3–5",
   "red": ">5",
   "direction": "Lower is better",
   "rationale": "Unapproved AI use is where customer data and confidential information leak. Discoveries should fall after an amnesty and a clear approved-tool list; a count of zero with no active discovery method is not evidence of control. Starter threshold — no reliable industry benchmark exists yet; recalibrate after 3 months of your own data.",
   "data_source": "CASB / secure web gateway logs; expense reports; employee attestation",
   "tier": "Management",
   "emerging": true,
   "source_anchor": "NIST AI 600-1 (Generative AI Profile, Jul 2024)",
   "starter_threshold": true,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-FR-001-1",
   "group": "fraud",
   "group_label": "Fraud and payments",
   "risk_category": "Fraud Risk",
   "name": "Account Takeover (ATO) Rate",
   "description": "Number of confirmed account takeover incidents per 10,000 active accounts",
   "formula": "Confirmed ATO incidents / Active accounts × 10,000",
   "unit": "per 10K",
   "frequency": "Monthly",
   "green": "<1",
   "amber": "1–5",
   "red": ">5",
   "direction": "Lower is better",
   "rationale": "No authoritative public benchmark exists for confirmed ATO cases per 10,000 accounts, so these are starter thresholds — validate against your own data. Red at >5 per 10K signals inadequate authentication controls or an active ATO campaign.",
   "data_source": "Fraud detection platform (Sardine, Sift, Unit21) — confirmed ATO case count. Support ticket system (Zendesk, Intercom) — tickets tagged 'account-takeover' or 'unauthorized-access'. Active account count from database.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-10",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-FR-008-1",
   "group": "fraud",
   "group_label": "Fraud and payments",
   "risk_category": "Fraud Risk",
   "name": "ACH Return Rate — Unauthorized",
   "description": "ACH return rate for unauthorized return codes (R05, R07, R10, R11, R29, R51) as a percentage of total ACH debits",
   "formula": "ACH debit returns with unauthorized codes (R05/R07/R10/R11/R29/R51) / Total ACH debit originations × 100",
   "unit": "%",
   "frequency": "Monthly",
   "green": "<0.3%",
   "amber": "0.3%–<0.5%",
   "red": "≥0.5%",
   "direction": "Lower is better",
   "rationale": "Nacha sets a 0.5% unauthorized debit return rate threshold (return codes R05, R07, R10, R11, R29 and R51); an Originator above it can face a Nacha inquiry and enforcement, and your ODFI will require a plan to bring it down. Red starts at that line; Amber (0.3%–<0.5%) is the warning buffer. Nacha also sets 3% administrative and 15% overall return rate levels.",
   "data_source": "ACH processor / bank partner returns file. ODFI (bank partner) provides return files. Nacha unauthorized return codes: R05 (unauthorized debit to consumer account using corporate SEC code), R07 (authorization revoked by customer), R10 (customer advises not authorized), R11 (customer advises entry not in accordance with the terms of the authorization), R29 (corporate customer advises not authorized), R51 (item related to RCK entry is ineligible or RCK entry is improper).",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-PM-004-1",
   "group": "fraud",
   "group_label": "Fraud and payments",
   "risk_category": "Payments Risk",
   "name": "Card Dispute and Fraud Ratio (Visa VAMP basis)",
   "description": "Card fraud reports plus disputes as a percentage of settled card-not-present transactions — the ratio Visa's Acquirer Monitoring Program (VAMP) uses",
   "formula": "(Fraud reports (TC40) + Disputes (TC15)) / Settled card-not-present transactions × 100, monthly",
   "unit": "%",
   "frequency": "Monthly",
   "green": "<0.75%",
   "amber": "0.75%–<1.5%",
   "red": "≥1.5%",
   "direction": "Lower is better",
   "rationale": "Per Visa's VAMP program, which replaced VDMP and VFMP in 2025, the US merchant \"Excessive\" threshold is 1.5% from April 1, 2026 (with at least 1,500 fraud reports plus disputes in the month). Red is set at that line; Amber gives a buffer. Mastercard runs a separate excessive-chargeback program — confirm its current thresholds with your acquirer.",
   "data_source": "Payment processor chargeback reports: Stripe Dashboard > Radar > Disputes. Marqeta: Disputes report. Galileo: Chargeback summary. Bank partner dispute/chargeback summary. Nacha return rate for ACH.",
   "tier": "Management",
   "emerging": false,
   "source_anchor": "Visa Acquirer Monitoring Program (VAMP) — US Excessive threshold 1.5% from Apr 1, 2026",
   "starter_threshold": false,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  },
  {
   "id": "KRI-FR-003-6",
   "group": "fraud",
   "group_label": "Fraud and payments",
   "risk_category": "Fraud Risk",
   "name": "Instant Payment Fraud Loss Rate",
   "description": "Fraud losses on real-time payments (RTP, FedNow, instant payouts) as basis points of instant-payment volume.",
   "formula": "Fraud losses on instant payments / Instant payment volume × 10,000",
   "unit": "bps",
   "frequency": "Monthly",
   "green": "<2 bps",
   "amber": "2–5 bps",
   "red": ">5 bps",
   "direction": "Lower is better",
   "rationale": "Instant payments settle irrevocably, so losses cannot be recalled the way ACH or card payments sometimes can. Tracking them separately stops card and ACH performance from masking instant-payment exposure. Starter threshold — no reliable industry benchmark exists yet; recalibrate after 3 months of your own data.",
   "data_source": "Payments ledger by rail; fraud loss log",
   "tier": "Board",
   "emerging": true,
   "source_anchor": "Irrevocable settlement on RTP and FedNow",
   "starter_threshold": true,
   "revised": "2026-09",
   "hook_text": "",
   "hook_citation": "",
   "hook_url": "",
   "last_verified": "2026-10-14"
  }
 ]
}