Identity & AML review

1 · Nothing on this surface clears itself. Every disposition that releases a gate — false positive, or a true match confirmed and then resolved — requires a second reviewer who did not record it. Approver ≠ proposer is enforced in the database on the disposition row, exactly as it is on a disbursement, not by disabling a button in the client. Needs more information is the single-signature outcome precisely because it leaves the gate closed. A coordinator never self-clears.
2 · Backend gap — the data model does not exist yet. QiExchangeParticipant in packages/web-app/src/services/api/admin.ts carries id, userId, role, firstName, lastName, email — and nothing else. There is no per-participant identity status, no screening status, no last or next rescreen, no match record. profiles.kyc_status (none · pending_review · verified · rejected, per migration 20260727140000_profiles_kyc_status.sql) plus is_identity_verified and is_kyc_complete is the entire truth today, and it lives on profiles — so a counterparty who is not a platform user has no row at all. This surface needs screening_subjects / screening_runs / screening_matches / screening_dispositions before it can be honest. Today the console has only the org-wide KycSection.tsx with hardcoded items and no per-file view.
3 · Subjects are people and entities, not rows on a file. Screening is scoped to the subject; the exchange view is a projection. One disposition against one list entry releases every gate that subject is holding, across every exchange. Model it that way or the same alert gets disposed of three times with three different rationales.
4 · No console role may assert identity. kyc_status → verified is written only by the provider webhook path through the Vectr KYC workflow. Mark identity verified ships permanently disabled with its reason on hover, for coordinator, QI administrator and platform administrator alike — visible so the rule is legible, not hidden so it is merely absent.
5 · Staleness is a state, not a footnote — and a failed run degrades, never persists. A run that errors must move the subject to overdue. It must not leave the previous clear result standing, and an overdue subject must never render in a satisfied colour. Two of the three holds on this file are staleness rather than hits, which is the ordinary case: the exposure is identical and the signal is quieter.
6 · A true match is a workflow, not a status change. Confirmation freezes every disbursement on the file including already-approved ones, raises a blocking report task with its own clock, and records a SAR determination — filed, or considered and documented as not filed. Both outcomes are written. Tipping-off suppression turns on the moment the option is selected, and the subject is never told a screening review is under way.
7 · The gate holds money and filing; it does not hold the clock. The 45- and 180-day dates are statutory and do not move because a screening hold is open. They are adjusted only through an approved four-eyes override carrying a legal basis, and the surface says so rather than letting a coordinator infer that the deadline is somehow paused.
8 · The audit is append-only and duplicated. Every run, list-edition load, failed run, disposition, second review and document-image view is one immutable row, forwarded to the Vectr audit log as it is written so the two can be reconciled. No role edits or deletes a row.
9 · Provenance pills mark what is not built. Adverse media is not connected, the engine does not expose per-component score contributions, the provider's document images and liveness artefacts are not surfaced in the console, and the SDN entry shown here is synthetic and not a real OFAC record. A list the platform cannot search renders as not connected, never as a clear result.
10 · Regulatory copy is cite-checked before it ships. Report windows, retention periods and determination language on this surface are placeholders written to be reviewed by compliance counsel, not authority in themselves. The product states obligations; it never gives legal or tax advice.
Light and dark are both designed.

All parties, entities, amounts, references and document numbers on this surface are synthetic demo data. SDN 44182 is not a real OFAC record, and the sanctions match adjudicated here is fabricated for design review — no real person, organisation or list record is depicted. A fabricated screening hit against a named individual never renders without this disclosure, in the demo shell or out of it.