![](media/image1.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**REGULATORY-SPECIFIC TPRM PACKAGES**

**PACKAGE 1: OCC-SPECIFIC VENDOR DUE DILIGENCE**

**Office of the Comptroller of the Currency**

**For:** National Banks, Federal Savings Associations, Federal Branches
of Foreign Banks\
**Regulatory Basis:** OCC Bulletin 2013-29 (Third-Party Relationships),
OCC Bulletin 2017-7 (Third-Party Relationships Frequently Asked
Questions), OCC Bulletin 2023-17 (Third-Party Relationships: Interagency
Guidance)

**EXECUTIVE SUMMARY FOR OCC-REGULATED INSTITUTIONS**

  Item                                        Phase Mirror Response
  ------------------------------------------- -----------------------------------------------------------
  **Vendor Name**                             Proof Labs LLC d/b/a Phase Mirror
  **Service Category**                        AI Governance SaaS Platform & Professional Services
  **Risk Tier Recommendation**                Critical / Significant (depending on AI systems governed)
  **OCC Bulletin 2013-29 Alignment**          ✅ Fully Aligned
  **Interagency Guidance (2023) Alignment**   ✅ Fully Aligned

**SECTION 1: OCC THIRD-PARTY RISK LIFECYCLE ALIGNMENT**

**1.1 Planning (OCC Bulletin 2013-29, Section III.A)**

**OCC Expectation:** Banks should develop a plan that outlines the
bank\'s strategy for using third parties.

  OCC Requirement                                               Phase Mirror Evidence
  ------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  Business case for third-party relationship                    Phase Mirror provides AI governance infrastructure addressing the structural gap between AI autonomy and enterprise governance---a documented need for OCC-regulated institutions deploying AI [^[\[1\]]{.underline}^](#qvire464ygj0)
  Assessment of prospective third party\'s ability to perform   SOC 2 Type II certified, \[X\] financial services customers, specialized Financial Services Compliance Pack [^[\[2\]]{.underline}^](#18iy5ch04a08)
  Inherent risks of the activity                                AI governance is a compliance-enabling function; reduces model risk, supports SR 11-7 alignment
  How third party will help achieve bank\'s strategic goals     Enables defensible AI governance architecture required for regulatory examination

**1.2 Due Diligence and Third-Party Selection (OCC Bulletin 2013-29,
Section III.B)**

**OCC Expectation:** Due diligence should provide bank management with
sufficient information to assess the third party\'s ability to meet
contractual obligations.

**Phase Mirror Due Diligence Package Contents:**

  Due Diligence Area                    OCC Guidance                         Phase Mirror Evidence
  ------------------------------------- ------------------------------------ ------------------------------------------------------------------------------------
  **Business Background**               Reputation, complaints, litigation   Clean record, no material litigation, D&B rating \[X\]
  **Financial Condition**               Financial stability assessment       \[Profitable/funded\], \$\[X\]M insurance coverage, financials available under NDA
  **Legal and Regulatory Compliance**   Compliance with applicable laws      GLBA compliant, SOC 2 certified, no regulatory actions
  **Experience and Qualifications**     Expertise in proposed activities     AI governance specialists, \[X\] financial services implementations
  **Operational Capabilities**          Capacity to deliver services         Tiered service levels, 99.5-99.9% uptime SLA, dedicated support
  **Information Security**              Security policies and practices      SOC 2 Type II, encryption, MFA, annual penetration testing
  **Reliance on Subcontractors**        Fourth-party oversight               Sub-processor list published, 30-day notice of changes, all SOC 2 certified
  **Business Continuity**               BCP/DRP adequacy                     Documented BCP/DRP, tested annually, RTO 4-24 hours, geo-redundant
  **Incident Response**                 Breach notification capabilities     24-hour notification SLA, documented IRP, tested semi-annually

**1.3 Contract Negotiation (OCC Bulletin 2013-29, Section III.C)**

**OCC Expectation:** Contracts should specify the rights and
responsibilities of each party.

  OCC Contract Element           Phase Mirror Provision                                      Reference
  ------------------------------ ----------------------------------------------------------- -----------------------------
  **Scope of services**          Detailed in Services Agreement and SOW                      ToS Section 2-3
  **Performance measures**       SLA with uptime guarantees, response times                  SLA Exhibit
  **Right to audit**             Annual audit rights + for-cause audits                      DPA Article 4.8
  **Confidentiality**            Comprehensive confidentiality provisions                    ToS Section 16
  **Business resumption**        BCP/DRP requirements, RTO/RPO commitments                   SLA Exhibit
  **Indemnification**            Mutual indemnification, breach coverage                     ToS Section 15
  **Limits on liability**        12 months fees (negotiable for significant relationships)   ToS Section 14
  **Insurance**                  \$\[X\]M cyber, \$\[X\]M E&O, certificates provided         Insurance Exhibit
  **Dispute resolution**         Defined escalation and resolution process                   ToS Section 19
  **Termination**                30-day for convenience, immediate for cause, data return    ToS Section 11
  **Subcontractor management**   Flow-down requirements, approval rights                     DPA Article 4.3
  **Foreign-based services**     US-based primary operations, data residency options         DPA Annex I
  **Regulatory compliance**      GLBA, OCC examination cooperation                           Financial Services Addendum
  **Data ownership**             Customer retains ownership of all data                      ToS Section 5

**1.4 Ongoing Monitoring (OCC Bulletin 2013-29, Section III.D)**

**OCC Expectation:** Banks should establish an ongoing monitoring
program for third-party relationships.

**Phase Mirror Ongoing Monitoring Support:**

  Monitoring Activity        Frequency   Phase Mirror Deliverable
  -------------------------- ----------- ------------------------------------------------
  **Performance review**     Quarterly   Customer success review, metrics dashboard
  **Financial condition**    Annual      Updated D&B report, financial attestation
  **Security posture**       Annual      Updated SOC 2 report, penetration test summary
  **Compliance status**      Annual      Compliance attestation, updated certifications
  **Subcontractor review**   Quarterly   Updated sub-processor list
  **BCP/DRP testing**        Annual      Test results summary
  **Incident review**        Ongoing     Incident reports (if any), annual summary
  **Contract compliance**    Annual      Self-assessment, SLA performance report

**Automated Monitoring:**

-   Status page:
    > [[https://status.phasemirror.com]{.underline}](https://status.phasemirror.com)
    > (real-time)

-   Quarterly business reviews (Enterprise tier)

-   Proactive notification of material changes (30 days)

**1.5 Termination (OCC Bulletin 2013-29, Section III.E)**

**OCC Expectation:** Banks should develop contingency plans for
terminating relationships.

  Termination Element           Phase Mirror Provision
  ----------------------------- --------------------------------------------------
  **Data return/destruction**   30 days post-termination, certification provided
  **Transition assistance**     Available (fee-based for extended periods)
  **Knowledge transfer**        Documentation, training for successor
  **Ongoing access**            API access during transition (30 days)
  **Alternative providers**     Documented in customer\'s contingency plan
  **Intellectual property**     Customer-created content fully owned by customer

**SECTION 2: OCC 2023 INTERAGENCY GUIDANCE ALIGNMENT**

**2.1 Sound Risk Management Throughout the Lifecycle**

  Interagency Principle                  Phase Mirror Alignment
  -------------------------------------- ---------------------------------------------------------------------
  **Commensurate with level of risk**    Tiered service levels match risk profile (Team/Business/Enterprise)
  **Considers nature and criticality**   Implementation assessment determines appropriate controls
  **Manages concentration risk**         Multi-cloud architecture, no single points of failure
  **Addresses fourth-party risk**        Published sub-processor list, flow-down requirements

**2.2 Governance and Risk Management Framework**

  Framework Element                  Phase Mirror Support
  ---------------------------------- ----------------------------------------------------------
  **Oversight and accountability**   Dedicated TAM (Enterprise), named account contacts
  **Independent risk management**    SOC 2 independent audit, third-party penetration testing
  **Documentation**                  Comprehensive TPRM package, contract documentation
  **Reporting**                      Quarterly business reviews, annual compliance reports

**2.3 Considerations for Third-Party Relationships Involving Critical
Activities**

**Phase Mirror as a Critical Activity Provider:**

  Critical Activity Consideration   Phase Mirror Response
  --------------------------------- ----------------------------------------------------------------
  **Heightened due diligence**      This comprehensive TPRM package addresses all OCC requirements
  **Enhanced ongoing monitoring**   Quarterly reviews, dedicated TAM, proactive communications
  **Robust business continuity**    99.9% SLA, 4-hour RTO, 1-hour RPO (Enterprise tier)
  **Comprehensive contracts**       All OCC-required provisions included
  **Clear escalation paths**        Defined escalation to CISO, CEO for critical issues

**SECTION 3: MODEL RISK MANAGEMENT (SR 11-7) SUPPORT**

**OCC Bulletin 2011-12 (Sound Practices for Model Risk Management)
Alignment:**

Phase Mirror\'s Financial Services Compliance Pack directly supports SR
11-7:[^[\[2\]]{.underline}^](#18iy5ch04a08)

  SR 11-7 Component         Phase Mirror Support
  ------------------------- ----------------------------------------------------------------------------------
  **Model Development**     Documentation of AI system design decisions, governance choices
  **Model Validation**      Dissonance Reports identifying gaps between stated governance and implementation
  **Model Use**             Tracking production deployment, monitoring commitments
  **Model Governance**      Audit trails of policy decisions, approval workflows
  **Model Inventory**       AI system registry with risk classifications
  **Effective Challenge**   Methodology surfaces contradictions that enable effective challenge

**SR 11-7 Documentation Outputs:**

-   Model risk assessment templates

-   Validation documentation frameworks

-   Ongoing monitoring specifications

-   Model change documentation

-   Board reporting templates

**SECTION 4: OCC EXAMINATION SUPPORT**

**4.1 Pre-Examination Preparation**

**Phase Mirror provides for OCC exams:**

  Document                          Availability                 Turnaround
  --------------------------------- ---------------------------- -----------------
  Vendor management documentation   ✅ This package               Immediate
  Contract and amendments           ✅ Upon request               2 business days
  SOC 2 Type II report              ✅ Under NDA                  1 business day
  Due diligence evidence            ✅ Upon request               3 business days
  Performance metrics/SLA reports   ✅ Upon request               5 business days
  Incident history                  ✅ Upon request               3 business days
  Sub-processor documentation       ✅ Published list + details   2 business days
  BCP/DRP evidence                  ✅ Upon request               3 business days

**4.2 During Examination**

**Phase Mirror commits to:**

-   Direct engagement with examiners as requested by customer

-   Timely response to information requests (within 48 hours)

-   On-site meetings if required (with reasonable notice)

-   Technical demonstrations of governance controls

-   Clarification of technical capabilities

**4.3 Post-Examination**

**If findings relate to Phase Mirror:**

-   Review findings with customer within 5 business days

-   Develop remediation plan if required

-   Implement enhanced controls as needed

-   Document remediation for follow-up examination

-   Provide attestation of corrective action

**SECTION 5: OCC-SPECIFIC CONTRACTUAL ADDENDUM**

**Recommended additions for OCC-regulated institutions:**

OCC REGULATORY ADDENDUM\
\
1. EXAMINATION COOPERATION\
Vendor agrees to cooperate fully with examinations by the Office of the\
Comptroller of the Currency, including providing access to records,\
personnel, and facilities as reasonably requested.\
\
2. RECORDS RETENTION\
Vendor shall retain records related to services provided to Bank for a\
minimum of seven (7) years or such longer period as required by
applicable\
law or regulation.\
\
3. AUDIT RIGHTS\
Bank and its regulators (including OCC) shall have the right to audit\
Vendor\'s operations and controls. Vendor shall provide reasonable
access\
to facilities, personnel, and records.\
\
4. SUBCONTRACTOR OVERSIGHT\
Vendor shall not engage subcontractors for material functions without\
Bank\'s prior written consent. All subcontractors shall be subject to\
equivalent contractual requirements.\
\
5. BUSINESS CONTINUITY\
Vendor shall maintain business continuity and disaster recovery plans\
tested annually. Bank shall be notified of any material disruptions\
within four (4) hours.\
\
6. INCIDENT NOTIFICATION\
Vendor shall notify Bank within twenty-four (24) hours of any security\
incident, data breach, or material operational disruption affecting\
Bank\'s data or services.\
\
7. MODEL RISK MANAGEMENT\
If services involve model development or validation, Vendor shall\
maintain documentation and controls consistent with OCC Bulletin
2011-12\
(Model Risk Management).\
\
8. GLBA COMPLIANCE\
Vendor certifies compliance with the Gramm-Leach-Bliley Act, including\
Safeguards Rule requirements for protection of customer information.\
\
9. TERMINATION ASSISTANCE\
Upon termination, Vendor shall provide transition assistance for up to\
ninety (90) days, including data migration support and knowledge
transfer.\
\
10. CONCENTRATION RISK\
Vendor shall notify Bank of any circumstances that could create\
concentration risk, including significant customer losses, financial\
distress, or operational issues affecting service delivery.

**SECTION 6: OCC RISK ASSESSMENT TEMPLATE**

**Complete this assessment for your institution:**

**Risk Rating Determination**

  Factor                          Score (1-5)   Weight   Weighted Score
  ------------------------------- ------------- -------- ----------------
  **Criticality to operations**   \_\_\_        20%      \_\_\_
  **Data sensitivity**            \_\_\_        15%      \_\_\_
  **Regulatory impact**           \_\_\_        15%      \_\_\_
  **Financial exposure**          \_\_\_        10%      \_\_\_
  **Operational complexity**      \_\_\_        10%      \_\_\_
  **Substitutability**            \_\_\_        10%      \_\_\_
  **Subcontractor reliance**      \_\_\_        10%      \_\_\_
  **Geographic risk**             \_\_\_        10%      \_\_\_
  **TOTAL**                                     100%     \_\_\_

**Risk Tier:**

-   Score 4.0-5.0: Critical

-   Score 3.0-3.9: Significant

-   Score 2.0-2.9: Moderate

-   Score 1.0-1.9: Low

**Approval Requirements (per OCC guidance)**

  Risk Tier     Approval Required
  ------------- ------------------------------------
  Critical      Board or Board Committee
  Significant   Senior Management + Risk Committee
  Moderate      Business Line + Risk Management
  Low           Business Line

**PACKAGE 2: FEDERAL RESERVE-SPECIFIC VENDOR DUE DILIGENCE**

**Board of Governors of the Federal Reserve System**

**For:** State Member Banks, Bank Holding Companies, Savings and Loan
Holding Companies, Foreign Banking Organizations\
**Regulatory Basis:** SR 13-19 (Guidance on Managing Outsourcing Risk),
SR 11-7 (Model Risk Management), Interagency Guidance on Third-Party
Relationships (2023)

**EXECUTIVE SUMMARY FOR FEDERAL RESERVE-REGULATED INSTITUTIONS**

  Item                              Phase Mirror Response
  --------------------------------- -----------------------------------------------------
  **Vendor Name**                   Proof Labs LLC d/b/a Phase Mirror
  **Service Category**              AI Governance SaaS Platform & Professional Services
  **SR 13-19 Alignment**            ✅ Fully Aligned
  **SR 11-7 Alignment**             ✅ Supported via Financial Services Compliance Pack
  **Interagency Guidance (2023)**   ✅ Fully Aligned

**SECTION 1: SR 13-19 OUTSOURCING RISK MANAGEMENT ALIGNMENT**

**1.1 Risk Assessment Prior to Engagement**

**Federal Reserve Expectation:** Institutions should assess the risks of
outsourcing activities before entering arrangements.

  SR 13-19 Risk Factor   Phase Mirror Assessment
  ---------------------- --------------------------------------------------------
  **Strategic risk**     Low - Aligns with regulatory mandate for AI governance
  **Reputation risk**    Low - Clean record, no adverse publicity
  **Compliance risk**    Low - GLBA compliant, supports regulatory compliance
  **Operational risk**   Low - SOC 2 certified, documented BCP/DRP
  **Transaction risk**   Low - Defined SLAs, performance monitoring
  **Credit risk**        Low - \[Profitable/funded\], adequate insurance
  **Country risk**       Low - US-based primary operations

**1.2 Due Diligence Requirements**

**Phase Mirror Due Diligence Evidence per SR 13-19:**

  SR 13-19 Element                     Evidence Provided
  ------------------------------------ ----------------------------------------------------------------
  **Financial condition**              D&B report, insurance certificates, financial statements (NDA)
  **Relevant experience**              \[X\] financial services customers, case studies available
  **Service reputation**               Customer references, clean regulatory record
  **Security and internal controls**   SOC 2 Type II report, security documentation
  **Technology environment**           Architecture documentation, encryption standards
  **Human resources**                  Background checks, security training program
  **Business recovery capability**     BCP/DRP documentation, test results
  **Contractual terms**                Standard MSA with all Fed-required provisions
  **Subcontracting arrangements**      Published sub-processor list, flow-down requirements

**1.3 Contractual Provisions Required**

**Federal Reserve-Required Contract Elements:**

  SR 13-19 Contract Requirement   Phase Mirror Contract Provision
  ------------------------------- ------------------------------------------------------
  **Scope of services**           Detailed in Services Agreement, SOW, Exhibits
  **Service standards**           SLA with uptime, response times, performance metrics
  **Audit rights**                Annual + for-cause, Fed examination cooperation
  **Confidentiality**             Comprehensive provisions, GLBA alignment
  **Ownership of data**           Customer retains full ownership
  **Business resumption**         BCP/DRP requirements, RTO/RPO commitments
  **Subcontracting provisions**   Prior approval, flow-down, Fed access
  **Foreign facilities use**      Disclosed, US primary, data residency options
  **Compliance with laws**        Comprehensive compliance commitment
  **Insurance**                   \$\[X\]M cyber, \$\[X\]M E&O, certificates provided
  **Default and termination**     Clear triggers, data return, transition assistance
  **Indemnification**             Mutual indemnification, breach coverage
  **Dispute resolution**          Defined escalation and resolution process
  **Regulatory examination**      Full cooperation commitment

**SECTION 2: SR 11-7 MODEL RISK MANAGEMENT SUPPORT**

**2.1 Phase Mirror\'s Role in Model Risk Framework**

**SR 11-7 defines model as:** \"A quantitative method, system, or
approach that applies statistical, economic, financial, or mathematical
theories, techniques, and assumptions to process input data into
quantitative estimates.\"

**Phase Mirror supports institutions using AI/ML models by providing:**

  SR 11-7 Pillar          Phase Mirror Support                                     Deliverable
  ----------------------- -------------------------------------------------------- ---------------------------------------------------------------
  **Model Development**   Governance framework for AI development                  Specs, documentation templates
  **Model Validation**    Dissonance detection between policy and implementation   Dissonance Reports
  **Model Use**           Monitoring governance in production                      Ongoing monitoring dashboards
  **Governance**          Board-level reporting, audit trails                      C Board Packet outputs [^[\[3\]]{.underline}^](#xn9olrp1dxtg)

**2.2 Model Risk Documentation Support**

**Phase Mirror Financial Services Compliance Pack
includes:**[^[\[2\]]{.underline}^](#18iy5ch04a08)

  SR 11-7 Documentation Requirement   Phase Mirror Template/Tool
  ----------------------------------- -----------------------------------------
  Model inventory                     AI system registry with classifications
  Model development documentation     Development governance templates
  Validation reports                  Dissonance Report framework
  Ongoing monitoring                  Governance monitoring specifications
  Model change documentation          Change governance workflows
  Limitations and assumptions         Assumption documentation templates
  Board reporting                     Executive summary templates

**2.3 Effective Challenge Support**

**SR 11-7 emphasizes \"effective challenge\" - Phase Mirror enables this
through:**

-   **Dissonance methodology:** Surfaces contradictions that might
    > otherwise go unnoticed[^[\[4\]]{.underline}^](#g14wtkxrdp2i)

-   **Independent review:** Provides external perspective on governance
    > gaps

-   **Audit trails:** Documents all governance decisions for examination

-   **Quantified risk:** Converts abstract concerns into measurable
    > levers

**SECTION 3: FEDERAL RESERVE EXAMINATION SUPPORT**

**3.1 Examination Preparation**

**For Federal Reserve examinations, Phase Mirror provides:**

  Examination Area                 Documentation Available
  -------------------------------- ----------------------------------------
  **Vendor management**            Complete TPRM package (this document)
  **Contract review**              Full agreement package
  **Risk assessment**              Pre-completed risk assessment template
  **Due diligence**                Evidence package
  **Ongoing monitoring**           Performance reports, SLA metrics
  **Model risk (if applicable)**   SR 11-7 documentation support

**3.2 Examiner Access**

**Phase Mirror commits to:**

  Access Type             Availability
  ----------------------- -----------------------------------
  Document requests       48-hour response
  Written inquiries       5 business day response
  Interviews/meetings     Scheduled within 10 business days
  On-site visits          With 30 days notice
  System demonstrations   Virtual or on-site as requested

**3.3 Matters Requiring Attention (MRAs)**

**If examination results in MRAs related to Phase Mirror:**

1.  **Immediate review** with customer within 5 business days

2.  **Root cause analysis** within 10 business days

3.  **Remediation plan** within 15 business days

4.  **Implementation** per agreed timeline

5.  **Evidence of remediation** for follow-up examination

**SECTION 4: FEDERAL RESERVE-SPECIFIC CONTRACTUAL ADDENDUM**

FEDERAL RESERVE REGULATORY ADDENDUM\
\
1. SR 13-19 COMPLIANCE\
Vendor acknowledges that Bank is subject to SR 13-19 (Guidance on\
Managing Outsourcing Risk) and agrees to support Bank\'s compliance\
with all applicable requirements.\
\
2. FEDERAL RESERVE EXAMINATION\
Vendor agrees to cooperate fully with examinations conducted by the\
Federal Reserve, including:\
(a) Providing access to records related to services provided to Bank;\
(b) Making personnel available for interviews;\
(c) Permitting on-site examinations with reasonable notice;\
(d) Providing documentation as requested by examiners.\
\
3. SR 11-7 MODEL RISK (IF APPLICABLE)\
If services involve development, validation, or use of models as\
defined in SR 11-7:\
(a) Vendor shall maintain documentation consistent with SR 11-7;\
(b) Vendor shall support Bank\'s model validation processes;\
(c) Vendor shall provide access to model documentation for examination.\
\
4. SUBCONTRACTOR MANAGEMENT\
(a) Vendor shall maintain a current list of all subcontractors;\
(b) Material subcontracting requires Bank\'s prior written approval;\
(c) All subcontractors shall be subject to equivalent requirements;\
(d) Bank and Federal Reserve shall have audit rights over
subcontractors.\
\
5. FOREIGN OPERATIONS\
(a) Vendor shall disclose all foreign operations affecting Bank\'s
data;\
(b) Vendor shall notify Bank of changes to foreign operations;\
(c) Data shall remain in United States unless Bank consents otherwise.\
\
6. BUSINESS CONTINUITY\
(a) Vendor shall maintain BCP/DRP tested at least annually;\
(b) Vendor shall notify Bank within 4 hours of material disruptions;\
(c) Bank shall receive annual attestation of BCP/DRP adequacy.\
\
7. CYBERSECURITY\
(a) Vendor shall comply with sound cybersecurity practices;\
(b) Vendor shall notify Bank within 24 hours of security incidents;\
(c) Vendor shall maintain independent security assessments (SOC 2).\
\
8. CONCENTRATION RISK\
Vendor shall notify Bank if:\
(a) Vendor experiences financial distress;\
(b) Vendor loses significant customers affecting viability;\
(c) Any circumstance arises that could affect service continuity.\
\
9. TERMINATION AND TRANSITION\
(a) Bank may terminate for convenience with 30 days notice;\
(b) Vendor shall provide transition assistance for up to 90 days;\
(c) All Bank data shall be returned or destroyed within 30 days;\
(d) Vendor shall certify data destruction in writing.\
\
10. RECORDS RETENTION\
Vendor shall retain records related to Bank services for minimum\
seven (7) years or as required by applicable law.

**SECTION 5: FEDERAL RESERVE RISK ASSESSMENT MATRIX**

**Complete for your institution:**

  Risk Category     Description                                 Score (1-5)   Mitigating Factors
  ----------------- ------------------------------------------- ------------- ---------------------------------
  **Strategic**     Alignment with institution\'s AI strategy   \_\_\_        Supports regulatory mandate
  **Reputation**    Impact if vendor has public issues          \_\_\_        Clean record, proactive comms
  **Compliance**    Regulatory compliance exposure              \_\_\_        GLBA compliant, SR 11-7 support
  **Operational**   Service delivery and reliability            \_\_\_        SOC 2, 99.9% SLA available
  **Transaction**   Processing accuracy and timeliness          \_\_\_        Defined SLAs, monitoring
  **Credit**        Vendor financial stability                  \_\_\_        Insurance, financial review
  **Country**       Foreign operations risk                     \_\_\_        US-based primary operations

**Overall Risk Rating:** ☐ High ☐ Moderate ☐ Low

**Recommended Actions:**

-   \[ \] Execute MSA with Federal Reserve addendum

-   \[ \] Establish quarterly monitoring cadence

-   \[ \] Include in annual vendor review cycle

-   \[ \] Document in enterprise risk inventory

**PACKAGE 3: SEC-SPECIFIC VENDOR DUE DILIGENCE**

**Securities and Exchange Commission**

**For:** Broker-Dealers, Investment Advisers, Investment Companies,
Transfer Agents, National Securities Exchanges\
**Regulatory Basis:** SEC Regulation S-P, SEC Regulation S-ID, SEC
Cybersecurity Rules, SEC AI Disclosure Guidance

**EXECUTIVE SUMMARY FOR SEC-REGULATED ENTITIES**

  Item                            Phase Mirror Response
  ------------------------------- -----------------------------------------------------
  **Vendor Name**                 Proof Labs LLC d/b/a Phase Mirror
  **Service Category**            AI Governance SaaS Platform & Professional Services
  **Regulation S-P Alignment**    ✅ Compliant
  **Regulation S-ID Alignment**   ✅ Supportive
  **SEC Cybersecurity Rules**     ✅ Supportive
  **SEC AI Disclosure Support**   ✅ Core Capability

**SECTION 1: SEC AI DISCLOSURE SUPPORT**

**1.1 Material AI Risk Disclosure Requirements**

**SEC has emphasized that companies must disclose material AI risks.**
Phase Mirror directly supports this
requirement:[^[\[1\]]{.underline}^](#qvire464ygj0)

  SEC Disclosure Consideration        Phase Mirror Support
  ----------------------------------- --------------------------------------------------------
  **Identifying material AI risks**   Dissonance methodology surfaces hidden governance gaps
  **Documenting AI governance**       Creates binding artifacts (specs, SLAs, policies)
  **Board oversight evidence**        C Board Packet outputs for fiduciary documentation
  **Risk quantification**             Converts abstract risks to measurable levers
  **Audit trail**                     7-year retention for examination/litigation

**1.2 AI Disclosure Documentation**

**Phase Mirror helps prepare for SEC AI disclosure by providing:**

  Disclosure Element         Phase Mirror Deliverable
  -------------------------- ----------------------------------------
  **AI system inventory**    Comprehensive AI system registry
  **Governance framework**   Documented governance artifacts
  **Risk identification**    Dissonance Reports identifying gaps
  **Mitigation measures**    Levers with owners, metrics, timelines
  **Board reporting**        Executive summary templates
  **Ongoing monitoring**     Governance monitoring dashboards

**SECTION 2: REGULATION S-P (PRIVACY) COMPLIANCE**

**2.1 Safeguards Rule Alignment**

**Regulation S-P requires administrative, technical, and physical
safeguards for customer information.**

  S-P Safeguards Requirement                  Phase Mirror Implementation
  ------------------------------------------- ----------------------------------
  **Designate employee(s) to coordinate**     CISO designated and qualified
  **Identify reasonably foreseeable risks**   Annual risk assessment conducted
  **Design and implement safeguards**         SOC 2 Type II certified controls
  **Oversee service providers**               Sub-processor management program
  **Evaluate and adjust program**             Annual security program review

**2.2 Service Provider Oversight**

**S-P requires oversight of service providers with access to customer
information:**

  S-P Service Provider Requirement          Phase Mirror Compliance
  ----------------------------------------- ----------------------------------------------
  **Select capable service providers**      SOC 2 certified, security program documented
  **Require safeguards by contract**        DPA includes security requirements
  **Monitor service provider compliance**   Annual SOC 2 audit, ongoing monitoring

**SECTION 3: SEC CYBERSECURITY RULES SUPPORT**

**3.1 Cybersecurity Risk Management**

**SEC cybersecurity rules require documented risk management:**

  SEC Cybersecurity Element                 Phase Mirror Evidence
  ----------------------------------------- ----------------------------------------------------
  **Written policies and procedures**       Information Security Policy (available under NDA)
  **Risk assessment**                       Annual enterprise risk assessment
  **User security and access**              MFA, RBAC, quarterly access reviews
  **Information protection**                Encryption at rest (AES-256), in transit (TLS 1.3)
  **Threat and vulnerability management**   Weekly scans, annual penetration testing
  **Incident response**                     Documented IRP, tested semi-annually
  **Business continuity**                   BCP/DRP, tested annually
  **Service provider oversight**            Sub-processor management program

**3.2 Incident Disclosure Support**

**If a cybersecurity incident occurs involving Phase Mirror:**

  SEC Requirement           Phase Mirror Commitment
  ------------------------- ------------------------------------------
  **Timely notification**   24-hour notification to customer
  **Incident details**      Comprehensive incident report
  **Remediation steps**     Documented remediation plan
  **Disclosure support**    Information for SEC Form 8-K/ADV filings

**SECTION 4: BROKER-DEALER SPECIFIC REQUIREMENTS**

**4.1 FINRA Rule 3110 (Supervision)**

**Phase Mirror supports supervisory obligations for AI systems:**

  Supervisory Obligation               Phase Mirror Support
  ------------------------------------ ----------------------------------
  **Written supervisory procedures**   Governance framework templates
  **Review and approval**              Workflow documentation
  **Ongoing monitoring**               Continuous governance monitoring
  **Documentation**                    Audit trail for examination

**4.2 Regulation SCI (Systems Compliance and Integrity)**

**For SCI entities, Phase Mirror supports:**

  SCI Requirement             Phase Mirror Relevance
  --------------------------- ---------------------------------------------------------
  **Capacity planning**       Auto-scaling infrastructure, capacity documentation
  **Business continuity**     BCP/DRP with defined RTO/RPO
  **Systems testing**         Annual penetration testing, regular vulnerability scans
  **Incident notification**   24-hour notification SLA

**SECTION 5: INVESTMENT ADVISER SPECIFIC REQUIREMENTS**

**5.1 Fiduciary Duty and AI**

**Investment advisers have fiduciary duties when using AI:**

  Fiduciary Consideration   Phase Mirror Support
  ------------------------- -----------------------------------------------
  **Best interest**         Governance ensures AI serves client interests
  **Disclosure**            Documentation supports ADV disclosure
  **Oversight**             Governance framework enables human oversight
  **Documentation**         Audit trail demonstrates fiduciary care

**5.2 Form ADV Disclosure**

**Phase Mirror helps document for ADV disclosure:**

-   AI systems used in advisory activities

-   Governance and oversight framework

-   Risks and limitations of AI systems

-   Human oversight procedures

**SECTION 6: SEC EXAMINATION SUPPORT**

**6.1 OCIE/Division of Examinations Preparation**

**For SEC examinations, Phase Mirror provides:**

  Examination Focus          Documentation Available
  -------------------------- -------------------------------------------------
  **Vendor due diligence**   Complete TPRM package
  **Contract review**        Full agreement package
  **Cybersecurity**          Security documentation, SOC 2
  **Privacy/S-P**            Safeguards documentation
  **AI governance**          Governance artifacts, methodology documentation
  **Supervision**            Workflow and approval documentation

**6.2 Document Production**

**Phase Mirror response times for SEC examinations:**

  Request Type                  Response Time
  ----------------------------- -----------------------------------
  Standard document requests    5 business days
  Urgent requests               48 hours
  On-site examination support   Scheduled within 10 business days
  Technical demonstrations      Virtual or on-site as requested

**SECTION 7: SEC-SPECIFIC CONTRACTUAL ADDENDUM**

SEC REGULATORY ADDENDUM\
\
1. REGULATION S-P COMPLIANCE\
(a) Vendor certifies compliance with Regulation S-P safeguards\
requirements applicable to service providers.\
(b) Vendor shall maintain administrative, technical, and physical\
safeguards consistent with S-P requirements.\
(c) Vendor shall notify Client immediately of any breach of\
customer information.\
\
2. SEC EXAMINATION COOPERATION\
(a) Vendor agrees to cooperate with examinations by the Securities\
and Exchange Commission, FINRA, and other securities regulators.\
(b) Vendor shall provide access to records related to services\
provided to Client.\
(c) Vendor shall make personnel available for interviews as requested.\
(d) Vendor shall permit on-site examinations with reasonable notice.\
\
3. CYBERSECURITY\
(a) Vendor shall maintain cybersecurity policies and procedures\
consistent with SEC cybersecurity rules.\
(b) Vendor shall notify Client within 24 hours of any cybersecurity\
incident affecting Client\'s data or services.\
(c) Vendor shall provide information necessary for Client\'s\
regulatory disclosures related to cybersecurity incidents.\
\
4. AI DISCLOSURE SUPPORT\
(a) Vendor shall maintain documentation of AI governance services\
sufficient to support Client\'s regulatory disclosure obligations.\
(b) Vendor shall provide information requested by Client for SEC\
filings related to AI risks and governance.\
(c) Vendor shall retain documentation for seven (7) years to\
support examination and litigation requirements.\
\
5. BOOKS AND RECORDS\
(a) Vendor acknowledges that records related to services may\
constitute Client\'s books and records under securities laws.\
(b) Vendor shall maintain and preserve such records in accordance\
with SEC Rules 17a-3, 17a-4 (broker-dealers) or Rule 204-2\
(investment advisers) as applicable.\
(c) Vendor shall provide access to records for regulatory examination.\
\
6. SUPERVISION SUPPORT\
(a) If services relate to activities requiring supervision under\
FINRA rules, Vendor shall maintain documentation supporting\
Client\'s supervisory obligations.\
(b) Vendor shall provide audit trails and reports as requested\
for supervisory review.\
\
7. FIDUCIARY SUPPORT (INVESTMENT ADVISERS)\
(a) Vendor acknowledges Client\'s fiduciary obligations to its\
advisory clients.\
(b) Vendor shall support documentation of fiduciary oversight of\
AI systems used in advisory activities.\
\
8. SUBCONTRACTOR MANAGEMENT\
(a) Vendor shall maintain oversight of all subcontractors consistent\
with Regulation S-P service provider requirements.\
(b) Material subcontracting requires Client\'s prior written approval.\
(c) Client and SEC shall have audit rights over subcontractors.\
\
9. BUSINESS CONTINUITY\
(a) Vendor shall maintain BCP/DRP consistent with securities\
industry requirements.\
(b) Vendor shall notify Client within 4 hours of material disruptions.\
(c) Vendor shall support Client\'s business continuity obligations.\
\
10. CONFIDENTIALITY\
(a) Vendor shall maintain confidentiality of all Client information,\
including customer information, trading information, and\
proprietary business information.\
(b) Vendor shall not use Client information except as necessary to\
provide contracted services.\
(c) Vendor personnel with access to Client information shall be\
subject to confidentiality obligations.

**SECTION 8: SEC RISK ASSESSMENT MATRIX**

**Complete for your entity:**

  Risk Category                Score (1-5)   Considerations
  ---------------------------- ------------- ---------------------------------------------------
  **Regulatory (S-P, S-ID)**   \_\_\_        GLBA compliant, safeguards documented
  **Cybersecurity**            \_\_\_        SOC 2 certified, security program mature
  **AI Disclosure**            \_\_\_        Documentation supports disclosure obligations
  **Supervision**              \_\_\_        Governance framework enables oversight
  **Fiduciary (if adviser)**   \_\_\_        Documentation demonstrates due care
  **Operational**              \_\_\_        SLAs defined, business continuity in place
  **Reputational**             \_\_\_        Clean record, no adverse regulatory history
  **Concentration**            \_\_\_        Substitutes available, transition plan documented

**Overall Risk Rating:** ☐ High ☐ Moderate ☐ Low

**Recommended Actions:**

-   \[ \] Execute MSA with SEC addendum

-   \[ \] Include in annual vendor risk assessment

-   \[ \] Document in compliance manual

-   \[ \] Establish monitoring cadence

**CROSS-REGULATOR COMPARISON**

**Requirements Matrix**

  Requirement                   OCC             Federal Reserve   SEC
  ----------------------------- --------------- ----------------- ----------------------------
  **Primary Guidance**          OCC 2013-29     SR 13-19          S-P, Cybersecurity Rules
  **Due Diligence**             Comprehensive   Comprehensive     Service provider oversight
  **Contract Requirements**     Detailed list   Detailed list     Safeguards focus
  **Audit Rights**              Required        Required          Required
  **Examination Cooperation**   Required        Required          Required
  **Business Continuity**       Required        Required          Required
  **Incident Notification**     Required        Required          Required
  **Subcontractor Oversight**   Required        Required          Required
  **Data Residency**            Disclosure      Disclosure        Not specified
  **Model Risk**                OCC 2011-12     SR 11-7           Varies by entity
  **AI Disclosure**             Emerging        Emerging          Material risk focus

**Unified Compliance Approach**

**Phase Mirror provides a single package addressing all three
regulators:**

  Component                        OCC            Fed            SEC
  -------------------------------- -------------- -------------- --------------
  **TPRM Package**                 ✅              ✅              ✅
  **Standard MSA**                 ✅              ✅              ✅
  **Regulatory Addendum**          OCC-specific   Fed-specific   SEC-specific
  **Security Documentation**       Same           Same           Same
  **Examination Support**          Same process   Same process   Same process
  **Model Risk (if applicable)**   Supported      Supported      Supported

**CONTACT FOR REGULATORY SUPPORT**

**Regulatory-Specific Inquiries:**

  Regulator                                      Contact                                                                                Response Time
  ---------------------------------------------- -------------------------------------------------------------------------------------- -----------------
  **OCC-regulated institutions**                 [[compliance-occ\@phasemirror.io]{.underline}](mailto:compliance-occ@phasemirror.io)   2 business days
  **Federal Reserve-regulated institutions**     [[compliance-fed\@phasemirror.io]{.underline}](mailto:compliance-fed@phasemirror.io)   2 business days
  **SEC-regulated entities**                     [[compliance-sec\@phasemirror.io]{.underline}](mailto:compliance-sec@phasemirror.io)   2 business days
  **Multi-regulator (bank holding companies)**   [[compliance\@phasemirror.io]{.underline}](mailto:compliance@phasemirror.io)           2 business days

**Examination Support (All Regulators):**

-   Email:
    > [[exam-support\@phasemirror.io]{.underline}](mailto:exam-support@phasemirror.io)

-   Phone: \[Dedicated line\]

-   Response: 48 hours (urgent: 24 hours)

These regulatory-specific packages provide tailored documentation for
each major financial regulator. Would you like me to create:

-   State regulator versions (NYDFS, state banking departments)

-   FINRA-specific package for broker-dealers

-   International regulator versions (FCA, ECB, MAS)

-   Combined multi-regulator package for complex institutions

-   Examination preparation checklists for each regulator?

⁂

1.  Phase Mirror\_ Consultation & SaaS.pdf

2.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

3.  Agentic Domain-Specific Reasoning.pdf

4.  A Clear Guide to Phase Mirror\'s Services.pdf

5.  Implementation Guide\_ Applying Phase Mirror Dissonance.pdf

6.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

7.  License\_ Strategic & Legal Analysis.pdf

8.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

9.  The Phase Mirror does not resolve dissonance---it names it.pdf

10. Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

11. The Phase of Mirror Dissonance.pdf
