Reconciling DAC8, CARF and CRS 2.0: One Reporting Engine, Three Regimes
DAC8, CARF and CRS 2.0 describe the same customers three ways. A reference design for one reporting engine that collects and validates once, then branches only at output.
Compliance & Risk
DAC8 Due Diligence: Self-Certification and User Onboarding Data Changes
DAC8 pushes tax-residence and TIN collection into your onboarding flow. Retrofit the data model and validation now, so users arrive reportable instead of leaving gaps to chase.
Class A Company Obligations Under NYDFS: When Scale Triggers Independent Audit and EDR
Once headcount or revenue crosses the NYDFS Class A threshold, Part 500 adds independent audits, EDR, centralised logging and privileged-access controls that reshape security architecture and budget.
NYDFS Part 500 Ransomware and Extortion Payment Reporting: The 24-Hour Playbook
Under NYDFS Part 500, a ransom payment must be reported within 24 hours and justified within 30 days. A playbook for the decision rights and evidence trail you need before the incident, not during it.
Immutable Backups With S3 Object Lock: Backups an Attacker Can’t Delete
Configure S3 Object Lock in compliance mode, separate the write credential from any delete power, and end with backups nothing on the network can erase.
NYDFS Part 500 Final Phase Is Live: The Asset Inventory and MFA Duties You Must Now Evidence
The final NYDFS Part 500 tranche made a maintained asset inventory and expanded MFA mandatory on 1 November 2025. Here is how to build and evidence both.
Chaos Engineering for Regulated Resilience: Fault Injection Against Impact Tolerances
The most credible way to prove an impact tolerance is to break the service on purpose and measure whether you stay inside it. A practitioner’s reading of chaos engineering for CPS 230 resilience.
CPS 230 Scenario Testing: A Severe-But-Plausible Disruption Library for APRA Entities
CPS 230 expects credible, repeatable scenario testing of critical operations. A maintained severe-but-plausible disruption library with recorded outcomes is what separates demonstrated resilience from asserted resilience.
CPS 230 Critical Operations and Tolerance Levels: Building the Evidence
CPS 230 requires regulated entities to identify critical operations, set tolerance levels and demonstrate they operate within them. A practical playbook for building the evidence APRA now expects.
Impact Tolerances Have Teeth Now: Evidencing You Can Stay Within Them
Since 31 March 2025, UK firms must operate within impact tolerances for important business services. A policy that asserts resilience proves nothing; the build task is a scenario harness that tests it.