13.16 Compliance

User stories

• As a compliance officer, I want every regulatory obligation tracked and evidenced.
• As a borrower, I want a clear grievance route.
• As an internal auditor, I want immutable audit trail of every action.

API requirements

• POST /compliance/grievances, PUT /compliance/grievances/{id} (status).
• GET /compliance/dashboards/monthly.
• GET /audit/events?actor={a}&resource={r}.

Data model

• grievance, grievance_status, audit_event (hash-chained), consent (already in 13.4).

UI screens

• Borrower: grievance submission + tracking.
• Compliance: grievance queue, dashboards.

Backend services

• Grievance service.
• Audit service.
• Consent ledger service.

External integrations

• RBI Ombudsman portal (escalation handoff).

Test cases

• Grievance lifecycle.
• Audit log integrity verifiable.
• Consent retrievable for any borrower at any time.

Edge cases

• Borrower escalates to ombudsman.
• Stale consent — auto-prompt.
• Audit log tampering attempt.

Acceptance criteria

• Grievance SLA tracked + met.
• Audit log hash-chain validated daily.
• Internal Ombudsman queue (when applicable).