Risk Register
Tracked risks mapped to the policies that mitigate them.
| Risk | Description | Severity | Status | Coverage | Owner | Reviewed | Actions |
|---|---|---|---|---|---|---|---|
| Unauthorized large transfer | An agent moves a large sum to a counterparty it has never paid before. | Critical | MITIGATED | Deny high-value payments to an unknown counterparty, Hold limit increases above 3x the standing limit | Risk & Fraud | 8/16/2026 | |
| Account takeover via agent | An agent changes account details as a step toward account takeover. | Critical | MITIGATED | Step up on any credential or account-detail change | Risk & Fraud | 8/30/2026 | |
| Irreversible rail substitution | An agent settles over a same-day, final rail when the mandate named a reversible one. | Critical | MITIGATED | Hold settlement over an irreversible rail | Risk & Fraud | 7/30/2026 | |
| Counterparty screening bypass | An agent pays a counterparty that never cleared sanctions or watchlist screening. | Critical | MITIGATED | Deny payments to an unscreened counterparty | Risk & Fraud | 8/30/2026 | |
| Bulk data export by a compromised agent | An agent exports far more account data than a single interaction needs. | Critical | MITIGATED | Deny exports above a single-interaction volume | Risk & Fraud | 8/3/2026 | |
| Agent-issued refund fraud | An agent issues an unusually large refund to an account it doesn't recognize. | High | OPEN | No rule covers this | Risk & Fraud | — | |
| Mandate ceiling breach | Cumulative spend under a standing mandate passes the ceiling it registered. | High | MITIGATED | Hold spend past a registered mandate ceiling | Risk & Fraud | 8/27/2026 |