Working prototypes that blueprint what modern operational risk tooling should look like for mid-tier banks.
Every tool in this lab started as a gap I hit inside a bank: a regulatory expectation with no tooling behind it, a committee process held together by spreadsheets and goodwill, a question from an examiner that took three weeks to answer because the evidence lived in nine places.
The premise is simple. Operational risk tooling stagnated at the register stage while the discipline moved to resilience: services, tolerances, dependencies, testing, evidence. AI makes the missing instruments buildable, but only when the builder understands what a regulator will probe and what effective challenge has to capture. So I build them: as working prototypes and blueprints, not products.
Two constellations live here now. AEGIS is the platform blueprint: twelve modules forming one eGRC platform on a shared taxonomy spine, led by ORBIT, the operational resilience workbench, and built to the regimes North American and European supervisors examine against. MAJLIS is its Gulf sibling: eight modules for the regulatory universe of the GCC, from the central bank's model management standards to Islamic finance risk, on Gulf demo tenants in dirhams. Every build runs in the browser on a synthetic tenant, and the full roadmap, with architecture decisions and evaluation notes, is available on request.
The lab now publishes two suites. Same design language, same synthetic-data discipline, same taxonomy spine; different regulatory universes.
The platform blueprint: twelve modules forming one AI-native eGRC platform for mid-tier banks, built to the regimes North American and European supervisors examine against, from OSFI E-21 to DORA to the UK regime. ORBIT, the operational resilience workbench, leads.
The Gulf constellation: eight modules for banks and licensed fintechs in the Gulf's regulatory universe, from the CBUAE model management standards to Islamic finance risk, on synthetic Gulf tenants in AED. Named for the council where the Gulf talks governance.
Operational resilience workbench
ORBIT runs the resilience discipline end to end. Inventory the important business services, assess criticality, derive impact tolerances from harm curves, and map the dependency fabric underneath: people, process, technology, data, premises, third parties. The map exposes concentration and material points of failure.
Then the posture is proved under test: severe-but-plausible scenarios against a simulated clock, seeded Monte Carlo loss quantification translated into tolerance-breach probabilities per service, and findings that flow back into the map. Twelve regulatory frameworks are mapped, from OSFI E-21 to DORA to PRA SS1/21.
Everything runs in the browser on a fully seeded fictional bank. No signup, no data collected.
Every build runs in the browser on a synthetic demo tenant. No signup, no data collected.
Scenario analysis platform: severe-but-plausible narratives with quantified loss ranges, structured expert elicitation, and a two-pass challenger workflow under full governance.
KRI intelligence and early warning: a 45-indicator library with five years of history, lead-lag signal grading, breach workflows, and board narrative drafts.
Loss event classification: rules-first mapping of loss narratives across the full taxonomy spine, an AI second-pass challenger, and batch CSV mode.
Operational loss stress testing for CCAR: macro-conditioned frequency, spliced severities with EVT tails, legal-loss pipelines, and a Fed Lens reconciliation against the supervisory model.
Impact tolerance calibrator: derives and challenges tolerances per important business service across multiple harm dimensions, with a board translator.
Enterprise issues management: self-identified, audit, and regulatory issues run to ground through lifecycle workflows, with exposure aggregated across every taxonomy node.
Third-party dependency mapper: nth-party chains under critical services, concentration analysis, and hidden-common-vendor detection.
RCSA copilot: drafting assistance plus cross-unit consistency checks, staleness detection, and challenge of boilerplate rationales.
Regulatory change sentinel: obligation-level extraction from new issuances, delta detection against the control library, and applicability challenge.
Control rationalizer: semantic deduplication over a 300-control library, coverage gaps, and control-theatre heuristics with impact preview.
External loss intelligence: industry loss events structured into scenario inputs, relevance scoring, and could-it-happen-here translation.
The Gulf constellation, sibling to AEGIS. Eight modules for banks and licensed fintechs supervised under CBUAE, SAMA, QCB, DFSA, and ADGM regimes, on synthetic Gulf demo tenants in AED. Read about the build or open it at majlis.oprisk.ai.
Regulatory radar: the Gulf issuance stream tracked at obligation level across CBUAE, SAMA, QCB, DFSA, and ADGM sources, with applicability and delta views.
Model risk and AI governance under the CBUAE model management standards: inventory, risk tiering with governed overrides, validation findings, remediation heat.
Concentration analytics: large exposures, group resolution of connected counterparties including government-related entities, and a limit engine.
Climate scenario analysis for Gulf portfolios on NGFS framings, with transition deltas made legible at portfolio level.
IFRS 9 overlay governance: the post-model adjustment register, rationale, aging, and the challenge trail supervisors expect around ECL judgment.
Islamic finance risk toolkit: from profit-sharing investment account risk to Sharia governance, framed on IFSB standards and guidance.
Payments risk in a box for the newly supervised: obligations and controls shaped by the stored value and retail payment services regulations.
Financial crime effectiveness lab: screening effectiveness measured honestly, name-variant families, coverage claimed versus coverage demonstrated.
The OpRisk Signal carries this research as it publishes: one practitioner essay and the signal worth keeping, no noise. The full roadmap (sequencing, architecture decisions, and evaluation notes) is available on request.
