appendix-e

Appendix E. Translating regulation into engineering requirements

Every system in this book runs inside a regulated environment. Throughout the chapters we named laws and supervisory rules in passing; this appendix closes the loop by translating the ones that matter most into what an engineer actually has to design, build, log, and document.

Two cautions before the tables. First, regulation is jurisdiction-specific: a US national bank, an EU credit institution, and a Korean fintech face overlapping but different obligations. Second, effective dates and enforcement postures move—AI rules in particular were amended repeatedly through 2025 and 2026. Treat the dates here as the state of play in mid-2026 and re-verify before you ship. This appendix is not legal advice; it maps each obligation onto the part of your architecture that satisfies it.

E.1 Model risk and validation (Chapters 4–9)

Any model that drives a lending, pricing, or capital decision is a governed asset, not just code. Two supervisory regimes define this discipline.

Appendix E. Translating regulation into engineering requirements

E.1 Model risk and validation (Chapters 4–9)

E.2 Fair and explainable credit decisions (Chapters 4–6)

E.3 AI-specific regulation (the fast-moving frontier)

E.4 Communications, data protection, and automated decisions (Parts 4–5)

E.5 AML, payments, and operational resilience (Part 3 and cross-cutting)

E.6 The pre-production checklist