H33-74 for Banking

What gets attested in banking

Each of the following operational events emits an H33-74 proof at the moment it occurs. The collection composes into the operational history that audit, compliance, and regulatory teams reconstruct from.

• Credit and lending decisions: underwriting, approval, denial, exception override, renewal.
• Transfer authorizations: domestic, cross-border, correspondent banking, FX settlement.
• AML and sanctions screening determinations: customer onboarding, ongoing monitoring, SAR/CTR generation, watchlist hits.
• Fraud scoring outputs and human-override decisions.
• Model governance events: AI/ML model deployment, retraining, validation, deprecation.
• Account access and privilege changes: privileged access grants, segregation enforcement.
• Reconciliation outcomes: daily, settlement-window, period-end.

Regulatory pressure that already justifies this

Banking is regulated under frameworks whose audit horizons now extend past the lifetime of the systems and vendors holding the evidence. H33-74 produces evidence that survives that horizon:

• SOX. Section 302 and 404 ICFR for publicly listed bank holding companies. See: SOX crosswalk
• DORA. ICT risk management, incident reporting, resilience testing for EU financial entities. See: DORA crosswalk
• OSFI B-13. Technology and cyber risk supervision for Canadian FRFIs. See: OSFI B-13 crosswalk
• PCI-DSS. Cardholder data environment if card issuing or acquiring. See: PCI-DSS crosswalk
• FedRAMP. Federal cloud environments for government banking and treasury work. See: FedRAMP crosswalk

Scenarios this changes

Bank changes core platform after a vendor acquisition

The new core platform inherits zero operational history. H33-74 receipts from the old platform remain independently verifiable. Auditors examining 2027 transfer decisions in 2031 verify them directly against the proofs, not the deprecated core.

A regulator requests credit decisions from four years ago

The bank produces the original PQ-signed proofs for each decision. The policy version, signer, model version, and override chain are all part of the proof. No reconstruction. No vendor cooperation required.

Cryptographic concern forces chain change for treasury anchoring

The bank adds a new chain anchor for the historical receipt corpus in one batched commitment. The treasury asset is re-issued on the new chain as normal tokenization work. The evidence does not migrate.

What survives versus what gets replaced

How to start

Three integration patterns, ordered by how invasive each is.

Pattern 1 — Receipt at the policy engine

The decision system (policy engine, approval workflow, AI scorer) emits an H33-74 proof for every decision at the moment it is made. No change to upstream systems. Auditors verify proofs directly.

Pattern 2 — Receipt at the system of record

Each system of record (treasury, claims, records, EHR) is wrapped so that committed transactions emit H33-74 proofs in addition to the existing audit log. Existing systems remain unchanged. Proofs become a parallel canonical record.

Pattern 3 — Receipt at the integration bus

Service mesh or integration bus intercepts cross-system events and emits H33-74 proofs. Highest reach, requires bus integration. Useful where systems-of-record cannot be modified.

Related