# Operations Onboarding And Training

Last reviewed: 2026-07-01

Owner: Operations enablement
Approvers: Support, compliance/MLRO, finance, security, privacy, engineering
Audience: Support, compliance, finance, risk, and operations personnel

No production access is granted solely because this material was read. Access
requires role-specific training, assessment, manager approval, least-privilege
provisioning, MFA/passkey enrollment, policy acknowledgement, and supervised
practice. Training uses synthetic data in staging.

## Common Core

Every role completes:

1. Product boundaries: test/local providers versus licensed production services,
   feature flags, jurisdiction/product eligibility, and customer disclosures.
2. Architecture and data flows from `docs/architecture-and-data-flows.md`, including
   ledger source of truth and provider/reconciliation boundaries.
3. Authentication security: password manager, phishing-resistant MFA where
   available, sessions, JIT elevation, device hygiene, and incident reporting.
4. Data handling: PII, financial, KYC/AML, card, crypto, secret and SAR/STR classes;
   approved storage/export; redaction; clean-desk/screen-sharing rules.
5. Customer fairness, accessibility, vulnerability, complaints, confidentiality,
   conflicts of interest, and speaking-up/escalation duties.
6. Incident basics: severity, on-call routes, UTC timeline, request/trace IDs,
   evidence preservation, approved communications, and no speculative action.
7. Threat model and prohibited behavior: no shared accounts, direct balance edits,
   blind provider replay, unapproved SQL, customer secrets, or tipping off.

## Role Tracks

### Support

- Safe identity verification and contact-channel handling.
- Login/MFA, payments, cards, balance, KYC, FX, crypto, outage, privacy, and complaint
  playbooks from `docs/support-playbooks.md`.
- View-only support impersonation purpose, expiry, allowed actions, and audit.
- Recognizing takeover, fraud, vulnerability, complaint, data breach, and urgent
  customer-funds risk; correct queue and paging route.
- Customer-safe writing, accessibility, translation/localization boundaries, and
  promises/ETAs support may not make.

Practical assessment: triage one account-takeover report, one unknown payment, one
KYC review question, and one complaint without requesting prohibited data.

### Compliance And Risk

- KYC evidence/provider decisions, manual review, EDD, customer-risk scoring and
  periodic review.
- Sanctions, PEP, adverse-media, payment-release and ongoing screening disposition.
- AML/fraud case assignment, notes, evidence, SLA, linked alerts, false-positive
  feedback, rule governance, and quality assurance.
- Suspicion escalation, restricted SAR/STR workflow, no-tipping-off controls,
  filing evidence and jurisdiction control register.
- Complaint/regulatory escalation, privacy minimization, access/export monitoring,
  and independent review.

Practical assessment: disposition a synthetic sanctions false positive, escalate a
suspicious pattern, prepare an EDD plan, and identify information excluded from a
customer/support response.

### Finance

- Double-entry journals, projections, holds, settlement, reversals, trial balance,
  EOD snapshots and source-of-truth rules.
- Daily provider reconciliation, bridge analysis, break severity/status, corrective
  journals and evidence from `docs/runbooks/reconciliation-break.md`.
- Wallet adjustment and reversal maker-checker; separation from direct database
  manipulation.
- FX quotes/rates, rounding/minor units, treasury position/PnL, fees and exposure.
- Card authorization/clearing and payment/crypto provider outcome boundaries.

Practical assessment: investigate a provider-account mismatch, prove a reversal
link, verify a zero trial balance, and reject an unsafe temporary balance edit.

### Operations

- Provider interfaces, idempotency, timeout/unknown outcome, webhook signatures,
  ordering, deduplication, report ingestion and degraded mode.
- Settlement/payment states, manual holds/release, worker retry controls, customer
  notifications and operational queues.
- Deploy/rollback, provider outage, settlement break, webhook storm, incident,
  BCDR and reconciliation runbooks.
- Feature flags, dashboards/alerts, escalation matrix, provider tickets, and
  post-recovery financial checks.

Practical assessment: lead a tabletop provider outage with unknown payment outcome,
stop unsafe retries, choose a rollback/feature flag, and produce closure evidence.

### Privileged Administrators And Engineers

- Scoped RBAC/JIT, maker-checker, KMS/secret rotation, audit export and break-glass.
- Signed release/provenance, migration plans, database roles, backup/PITR, restore
  drills and immutable financial records.
- Secure logging/redaction, WAF/proxy trust, metrics boundary, incident forensics,
  provider credential and webhook-key rotation.
- Negative authorization, idempotency/race, state-machine, ledger invariant,
  contract, load, DAST and accessibility quality gates.

Practical assessment: verify a signed digest, review a migration/rollback plan,
rotate a synthetic webhook secret, and investigate an authorization regression.

## Training Sequence

| Stage | Required evidence | Production access |
| --- | --- | --- |
| Pre-start | Background/employment controls as applicable, confidentiality and policy acknowledgement | None |
| Common core | Completed modules and passing knowledge check | None |
| Role track | Passing practical scenarios and trainer signoff | None |
| Staging shadow | Synthetic case/change handled under supervision | Staging only |
| Production shadow | Read-only observation with named supervisor and approved scope | Time-limited read-only if needed |
| Authorized | Manager + system owner approval, MFA, role/scope/JIT configuration | Least privilege |
| Independent work | Quality sample after first cases/changes | Approved role scope |

Assessment failures require coaching and reassessment. A manager cannot waive a
mandatory security, financial, compliance, privacy, or regulatory competency.

## Access Provisioning Checklist

- Identity proofed; unique workforce identity and managed device active.
- MFA/passkey and recovery process enrolled; no shared credentials.
- Role, scopes, environment, time limit, owner, and business purpose approved.
- Conflicts/separation of duties checked, especially maker-checker and SAR access.
- Logging, alerting, session controls, export restrictions, and JIT expiry verified.
- User demonstrates escalation route and acknowledges prohibited actions.
- Access review and training renewal dates recorded.

Role changes, leave, termination, or investigation trigger immediate scope review,
session revocation as appropriate, and evidence retention. Dormant access is
removed automatically or through scheduled access certification.

## Exercises And Drills

At least quarterly, run a cross-functional tabletop or staging exercise selected
from:

- provider outage with unknown payment outcomes
- reconciliation break or ledger imbalance
- account takeover and suspicious beneficiary payment
- forged/replayed webhook or card callback storm
- stale FX feed and open treasury exposure
- crypto custody outage/address risk if crypto is in scope
- data breach or sensitive support attachment
- deployment rollback plus database compatibility decision
- complaint surge and vulnerable-customer handling

Every exercise records scenario, participants/roles, timeline, decisions, runbooks
used, alerts/evidence, control gaps, owners, due dates, and retest result.

## Recertification And Quality Monitoring

- Annual common-core and role recertification at minimum.
- Immediate targeted training after material policy/system/provider change or a
  control failure relevant to the role.
- Quarterly privileged-access certification and periodic sample review of support,
  compliance, finance and operations work.
- Track completion, assessment result, practical signoff, access granted, quality
  findings, retraining, expiry, and revocation in the approved learning/evidence
  system. Do not store unnecessary personal assessment data in application tables.

Training effectiveness is measured by decision quality, SLA adherence, escalation
accuracy, evidence completeness, prohibited-data incidents, access exceptions,
complaint outcomes, reconciliation aging, false-positive quality, and exercise
remediation closure, not completion percentage alone.

## Reference Pack

- `docs/architecture-and-data-flows.md`
- `docs/threat-model.md`
- `docs/compliance-operations-procedures.md`
- `docs/support-playbooks.md`
- `docs/deployment.md`
- `docs/runbooks/deploy.md`
- `docs/runbooks/rollback.md`
- `docs/runbooks/reconciliation-break.md`
- `docs/runbooks/major-incident-notification.md`
- `docs/card-data-scope.md`
- `docs/frontend-customer-experience.md`
- `docs/production-readiness-checklist.md`