# Production Readiness Checklist

Last updated: 2026-08-14

Scope: SwiftNet banking app, including the Go backend, React/TypeScript frontend, PostgreSQL data model, ledger, wallets, routing codes, virtual cards, SEPA simulation, crypto/stablecoins, savings goals, admin dashboard, RBAC/MFA/session management, rate limiting, suspicious login detection, observability, FX, payment limits, and risk events.

This checklist is an engineering and operations readiness document. It is not legal advice. Real-money launch must be approved by legal, compliance, risk, security, operations, and the relevant licensed financial partners.

## Status Legend

- `[x]` Present in the codebase or already implemented.
- `[~]` Partially present, needs production hardening or external validation.
- `[ ]` Not ready yet.
- `[GATE]` Real-money launch blocker.
- `[P0]` Must be done before real-money production.
- `[P1]` Must be done before broad customer rollout.
- `[P2]` Should be done before scale.

## Launch Decision

- `[x]` Demo or local development readiness: suitable for building and showing product workflows.
- `[~]` Staging readiness: repeatable staging compose, env template, seed command, smoke scripts and config hardening exist; still needs first live Docker/API smoke evidence in a clean environment.
- `[ ] [GATE]` Real-money production readiness: blocked until licensing/provider contracts, reconciliation, security hardening, compliance operations, and incident response are complete.

## Current Strengths In The Repo

- `[x]` Go API with migrations and PostgreSQL schema.
- `[x]` Multi-wallet and multi-currency fiat accounts.
- `[x]` Internal double-entry ledger model with balanced postings.
- `[x]` Virtual cards with freeze, cancel, webhook processing, and spending limit sync.
- `[x]` KYC/AML baseline workflows and admin queues.
- `[x]` Compliance operations for provider decision evidence, ongoing monitoring, customer risk scoring, EDD, regulatory reports, case notes, attachments, SLA, assignment, tuning and false-positive feedback.
- `[x]` Data protection operations for inventory, retention, DSAR, notices, encryption/backup attestations, residency policies and tamper-evident audit checks.
- `[x]` Crypto wallets, crypto assets, and stablecoin assets.
- `[x]` Savings goals with reserve/unreserve flows.
- `[x]` IBAN/BIC simulation through a local bank ledger provider.
- `[x]` Account and beneficiary routing codes exist, including transfer snapshots for payment audit history.
- `[x]` Contract-aware provider routing-code requirements are mapped by provider, country, network and currency, with admin management.
- `[x]` SEPA settlement simulation with retry, failure, refund, and ledger reversal/refund flow.
- `[x]` SEPA provider report ingestion, inbound payment processing, beneficiary sanctions screening and customer payment notifications exist for local/provider operations.
- `[x]` Reconciliation module with provider snapshots, breaks, runs, and admin dashboard.
- `[x]` Payment limits and risk events for transfers, FX conversions, and card authorizations.
- `[x]` Rate limiting, login attempt lockouts, suspicious login events, and admin security event dashboard.
- `[x]` Admin dashboard for compliance, user detail, ledger drill-down, settlements, reconciliation, risk, security, routing-code contracts, and wallet adjustments.
- `[x]` Four-eyes admin wallet balance adjustment approval.
- `[x]` RBAC, MFA/TOTP step-up, refresh-token rotation, and session management.
- `[x]` FX exchange rates, quotes, conversions, wallet sync, and balanced FX ledger postings.
- `[x]` Database migration planning, rollback coverage checks, state-machine constraints, index reviews, retry tests and archival policy records.
- `[x]` Basic Prometheus-style metrics endpoint.
- `[x]` React/TypeScript frontend with customer/admin workflows, step-up UX, disclosures, admin states, e2e and accessibility coverage.
- `[x]` Architecture/data-flow diagrams, threat model, operational runbooks, compliance/support procedures and role-based training material.
- `[x]` Provider integration control plane with production config gates, outbound call idempotency/retry/timeout/circuit-breaker controls, redacted audit trails, webhook replay/order protection, metrics and admin evidence endpoints.
- `[x]` Legal market-access control plane with regulated-activity decisions, operating model records, legal memo evidence placeholders, restricted-term approvals, provider contract controls, safeguarding model records, customer policy records, jurisdiction blocking rules and production config gates requiring legal references.
- `[x]` Go-live gate control plane with seeded Gate A/B/C records, admin dashboard, evidence validation, audit events, production config gates and runbook coverage for staging, beta and real-money launch decisions.

## 1. Licensing, Legal, And Market Access

- `[~] [GATE] [P0]` Regulated activity decision records exist for e-money issuance, payment initiation, account information, money transmission, card issuing, FX, crypto custody, stablecoins, savings/deposits, credit and investment services; still attach counsel-approved decisions before real-money launch.
- `[~] [GATE] [P0]` Operating model records exist for licensed entity, registered agent, sponsor bank, EMI/payment institution partner, bank-as-a-service partner or software-only model; still approve the chosen model with legal, compliance, risk, finance and operations.
- `[~] [GATE] [P0]` Legal memo evidence records exist for target jurisdictions; still attach counsel-approved jurisdiction memos before onboarding real customers.
- `[~] [GATE] [P0]` Restricted-term controls exist for "bank", "savings" and "deposit"; still complete jurisdiction-specific legal wording approval before public launch.
- `[~] [GATE] [P0]` Licensed bank/payment provider contract controls exist for real IBAN/account issuance; still sign and attach real provider contracts.
- `[~] [GATE] [P0]` Card issuer/processor contract controls exist; still sign and attach real issuer/processor certification and contract evidence.
- `[~] [GATE] [P0]` KYC, sanctions, PEP, adverse media and transaction monitoring provider contract controls exist; still sign and attach real provider contracts and SLAs.
- `[~] [GATE] [P0]` Crypto custody/provider contract controls exist and can support explicit disabled real movement; still sign custody/provider contracts or keep real crypto/stablecoin movement disabled.
- `[~] [GATE] [P0]` Safeguarding, client money, insolvency and funds segregation model records exist; still attach legal/finance-approved evidence.
- `[x] [P0]` Terms of service, privacy notice, fee schedule, risk disclosures, complaints policy and chargeback/dispute policy records exist with version/evidence requirements; final customer wording still needs legal-approved content.
- `[x] [P0]` Jurisdiction blocking and product eligibility rules exist with test-only/blocked seed records for target markets; final activation still depends on legal approval and provider evidence.

## 2. Provider Integrations

- `[x]` Local development providers exist for bank ledger, card issuer, custody, identity, and sanctions.
- `[x]` Provider integration records, admin dashboard, evidence fields and production risk detection exist for bank ledger, card issuer, identity, sanctions, custody, blockchain analytics, market data and payment rail providers.
- `[~] [GATE] [P0]` Local bank ledger provider is blocked by production-like config gates and provider records are ready; still wire the contracted licensed bank/payment provider adapter and attach contract evidence before real IBAN/account issuance.
- `[~] [GATE] [P0]` Local card issuer simulator is blocked by production-like config gates and card outbound/webhook controls exist; still wire the contracted issuer/processor adapter and attach processor certification evidence.
- `[~] [GATE] [P0]` Local KYC provider is blocked by production-like config gates and identity webhook replay/order/audit controls exist; still wire the contracted identity provider adapter and evidence retrieval before production KYC.
- `[~] [GATE] [P0]` Local sanctions provider is blocked by production-like config gates and sanctions outbound calls are audited through the provider executor; still wire contracted sanctions/PEP/adverse-media and ongoing-monitoring providers.
- `[~] [GATE] [P0]` Custody can be explicitly disabled when real crypto movement is off, and production-like config rejects local custody for real movement; still wire contracted custody before any real crypto/stablecoin movement.
- `[x] [P0]` Provider idempotency keys and retry policies exist through the central provider executor for wired outbound provider calls.
- `[x] [P0]` Provider timeout budgets, circuit breakers, degraded-mode config and fail-closed unavailable errors exist.
- `[x] [P0]` Provider request/response audit trails are stored in `provider_outbound_calls` with sensitive-field redaction and metrics.
- `[x] [P0]` Provider webhook HMAC verification, timestamp tolerance, replay protection, event deduplication and sequence ordering detection exist in the central webhook inbox; card issuer and identity/KYC webhooks are connected.
- `[x] [P1]` Provider sandbox test run records and admin evidence endpoints exist; real provider sandbox suites still need executed evidence before go-live.

## 3. Ledger, Balances, And Reconciliation

- `[x]` Ledger journal entries are immutable and balanced per currency.
- `[x]` Transfers, SEPA settlement refunds, savings movements, admin wallet adjustments, and FX conversions create ledger postings.
- `[x] [P0]` PostgreSQL ledger invariant tests cover migrated schema, internal transfers, journal balance, account-vs-ledger, wallet available/reserved checks, high-volume ledger validation, and rounding test vectors.
- `[x] [GATE] [P0]` Add daily reconciliation between provider balances and internal ledger balances.
- `[~] [GATE] [P0]` Reconciliation break tables, statuses and admin queue exist; still add assignment, notes, SLA and resolution ledger posting workflows.
- `[x] [P0]` Add end-of-day balance snapshots per account, wallet, currency, provider, and ledger account.
- `[x] [P0]` Add trial balance report by currency.
- `[x] [P0]` Add ledger export for finance/audit.
- `[x] [P0]` Add explicit reversal workflow for every money movement type.
- `[x] [P1]` Add high-volume ledger performance tests.
- `[x] [P1]` Add per-currency rounding policy and test vectors for FX and minor-unit differences.

## 4. Payments And SEPA

- `[x]` Internal transfers and simulated SEPA transfers exist.
- `[x]` SEPA retry/failure/refund flow exists for local simulation.
- `[x]` Beneficiary routing codes are stored and snapshotted on outbound transfers.
- `[x]` Outbound transfers validate beneficiary routing codes against configured provider route requirements before settlement queueing.
- `[x]` Admin settlement dashboard exists for pending, retried, failed, and events.
- `[~] [GATE] [P0]` SEPA provider operation hooks exist through settlement report ingestion, inbound processing and provider references; still connect a licensed payment rail/provider, credentials, certificates, delivery channels and certification evidence.
- `[~] [GATE] [P0]` Provider settlement file/report ingestion exists for idempotent report records, item matching, completion confirmation and failure/refund application; still map signed production provider file formats, signatures and reason-code catalogs.
- `[x]` Payment status state machine with allowed transitions, DB enforcement and tests exists.
- `[~] [P0]` Reason-code mapping exists for local SEPA, provider report completion/failure, sanctions, risk and admin review outcomes; extend to real provider failures, returns, recalls and rejects.
- `[~] [P0]` Beneficiary risk checks exist through routing-code validation, payment-limit risk checks and beneficiary sanctions screening before execution; still add provider-backed beneficiary reputation/fraud scoring, geography and account-age rules.
- `[~] [P0]` Contract-aware routing-code requirement maps, admin endpoints, audit events and dashboard management exist; still load signed real provider contract rules, verify provider certification evidence and add provider-specific reason-code validation.
- `[~] [P0]` Payment limits exist per platform/user, currency, rail/operation, amount and velocity; still add account, role, segment and geography dimensions.
- `[x] [P0]` Sanctions screening at payment creation and before release exists through the sanctions provider interface, with review-held outcomes stored for audit.
- `[x]` Manual review hold/release/reject flow exists for high-risk SEPA payments, including refund ledger posting on reject.
- `[x] [P1]` Payment confirmation and customer notifications exist as in-app notification records for created, completed, retried, failed/refunded, inbound and manual-review outcomes.
- `[x] [P1]` Inbound payment processing exists for provider references and creditor IBAN matching, with ledger crediting, wallet sync and unmatched-payment failure records.

## 5. Cards And PCI

- `[x]` Virtual card create/freeze/unfreeze/cancel and spending limit sync exist.
- `[x]` Card authorizations/webhook handling exists.
- `[~] [P0]` PAN/CVV is only returned through one-time card creation, default sensitive-card JSON redacts it, and raw card webhook/authorization payloads are redacted before storage; still complete formal PCI DSS scope validation.
- `[ ] [GATE] [P0]` Integrate real card issuer/processor.
- `[ ] [GATE] [P0]` Complete PCI DSS scope assessment with issuer/acquirer/QSA guidance.
- `[~] [P0]` Ensure no PAN/CVV is logged, persisted, exported, or exposed outside allowed scope; code guardrails and docs exist, but add CI data-leak scans, provider evidence and operational controls.
- `[ ] [P0]` Add card tokenization strategy and key management.
- `[ ] [P0]` Add card authorization ledger holds, clearing, reversal, expiry, and dispute flows if cards can spend real money.
- `[~] [P0]` Card authorization velocity limits exist; still add MCC/country controls and merchant risk rules.
- `[ ] [P1]` Add cardholder notifications and dispute UI.

## 6. FX, Multi-Currency, And Treasury

- `[x]` Exchange rates, quotes, admin rate creation, and FX conversions exist.
- `[x]` FX conversion syncs wallet/account balances and posts balanced ledger lines per currency.
- `[~] [P0]` Rates support source/provider metadata, timestamps, stale-after and fallback flags; still replace seeded/manual rates with a contracted production market-data source.
- `[x] [GATE] [P0]` Maker-checker approval for admin FX rate changes exists.
- `[x] [P0]` FX quote expiry enforcement tests and stale quote monitoring exist.
- `[~] [P0]` Configurable spreads, customer FX disclosures and customer FX movement limits exist; still add advanced fees and eligibility by currency pair.
- `[x] [P0]` Treasury inventory position and spread/PnL reporting exists.
- `[~] [P0]` Provider/market-data metadata, source timestamps and fallback rules exist; still wire a real provider adapter and provider SLA/error handling.
- `[x] [P1]` Customer-facing fee and exchange-rate disclosure exists in FX quote responses.
- `[x] [P1]` Audit export for FX rate changes and conversions exists.

## 7. Crypto And Stablecoins

- `[x]` Crypto assets, crypto wallets, stablecoin assets, and local custody simulation exist.
- `[~] [GATE] [P0]` Custody scope decision records exist and default to simulated-only with real movement disabled; still attach board/product approval for each launch jurisdiction.
- `[~] [GATE] [P0]` Jurisdiction-specific crypto legal memo workflow exists; still complete counsel-approved memos, licensing/registration evidence and expiry review before launch.
- `[~] [GATE] [P0]` Custody provider configuration exists with local custody real movement disabled; still integrate a contracted production custody provider or keep all real movement disabled.
- `[x] [P0]` Chain transaction model exists for deposit, withdrawal, pending, confirmed, failed and reversed states, including balance reservation/release/settlement behavior.
- `[~] [P0]` Wallet address risk screening exists through a blockchain analytics provider interface and local simulator; still connect a contracted production blockchain analytics provider and tune risk rules.
- `[x] [P0]` Travel rule process exists with originator/beneficiary records, provider references and accepted/rejected/not-required statuses.
- `[x] [P0]` Private-key/custody responsibility matrix exists with approval workflow for provider, custody model, key owner, signing, backup and recovery ownership.
- `[x] [P1]` Stablecoin issuer risk monitoring and supported-network controls exist with deposit/withdrawal enablement and minimum confirmations.

## 8. KYC, AML, Fraud, And Compliance Operations

- `[x]` KYC profile, document upload metadata, submission, provider webhook, AML screening, and AML cases exist.
- `[~] [P0]` Current providers are local simulators; evidence capture, provider decision history and provider webhook/audit tables are ready for real adapters.
- `[~] [GATE] [P0]` Identity verification provider decision/evidence storage exists; still connect a contracted identity provider, evidence retrieval, certification pack and production provider SLAs.
- `[~] [GATE] [P0]` Sanctions screening and ongoing monitoring workflows exist through the sanctions provider interface; still connect real sanctions, PEP, adverse media and ongoing monitoring providers with signed contracts.
- `[~] [P0]` Basic transaction/risk limit events exist; still add full AML/fraud typologies per product.
- `[x] [P0]` Customer risk scoring and periodic review schedule exist with risk tiers, factors, last review and next review dates.
- `[x] [P0]` Enhanced due diligence flow exists with requested evidence, due dates, decisions and admin audit.
- `[x] [P0]` Suspicious activity escalation and regulatory reporting workflow exists through AML case escalation, SAR/STR/CTR draft/review/submitted statuses and audit events.
- `[~] [P0]` Case management permissions, notes, attachments, SLA, assignment and audit trail exist; still split compliance roles beyond the broad compliance write scope.
- `[~] [P0]` Login suspicious-event rules and payment/card/FX limit rules exist; still add full account-takeover, crypto and typology-specific fraud rules.
- `[x] [P1]` Model/rule tuning dashboard and false-positive tracking exist with seeded tuning signals and feedback counters.

## 9. Authentication, Authorization, And Admin Controls

- `[x]` JWT access tokens, refresh-token rotation, sessions, RBAC scopes, MFA/TOTP, and step-up auth exist.
- `[x]` High-risk money, card, crypto, and admin money routes require step-up.
- `[~] [P0]` Login lockout and suspicious login detection exist; still add stronger device fingerprinting and customer/admin notifications.
- `[ ] [P0]` Add recovery codes and secure MFA reset process.
- `[ ] [P0]` Add admin role management UI with maker-checker approval.
- `[ ] [P0]` Add least-privilege scope management for admins beyond customer/admin role.
- `[ ] [P0]` Add just-in-time admin elevation with reason capture.
- `[ ] [P0]` Add session anomaly detection and remote session revocation alerts.
- `[ ] [P1]` Add WebAuthn/passkeys for admins and high-risk customers.

## 10. Application Security

- `[~] [P0]` Strict JSON decoding, security headers, host/TLS enforcement and CSRF protection are present; still attach production edge and security signoff evidence.
- `[~] [GATE] [P0]` Managed secret storage and KMS-backed key config gates exist; still connect real vault/KMS credentials and evidence per environment.
- `[~] [P0]` Key-rotation process and admin records exist for JWT, MFA encryption, card secrets, webhook secrets and provider credentials; still execute and evidence live rotations.
- `[~] [P0]` PostgreSQL-backed shared per-IP API rate limiting exists; still add per-user, per-route and risk-class limits, and consider Redis/API gateway/WAF for higher-throughput edge enforcement.
- `[~] [P0]` WAF/reverse proxy and TLS termination policy is documented and enforced by config gates; still load provider-specific managed rules and production certificates.
- `[~] [P0]` Dependency scanning, Go vulnerability scanning, npm audit, Gitleaks secret scanning and Trivy container image scanning exist in CI/CD; still add full SAST/code scanning and tune allowlists/thresholds.
- `[~] [P0]` DAST workflow exists for staging; still run it against the real staging URL and attach reports to the AppSec dashboard.
- `[~] [P0]` Penetration-test evidence records exist; still complete external test, remediation and retest before launch.
- `[x] [P0]` Secure logging policy and PII/secret redaction tests exist.
- `[x] [P0]` CSRF double-submit strategy exists for cookie-authenticated unsafe requests.
- `[x] [P1]` Vulnerability disclosure process exists in `SECURITY.md`; public bug bounty can be added later if desired.

## 11. Data Protection And Privacy

- `[x]` Audit events exist and new events are chained with SHA-256 tamper-evidence metadata.
- `[~] [GATE] [P0]` Data inventory and classification for PII, financial data, card data, crypto data, secrets and audit data exist; still complete legal/security review and owner signoff.
- `[~] [P0]` Lawful basis, retention periods and deletion/anonymization rules are modeled and seeded; still validate each policy with counsel and operational owners.
- `[x] [P0]` Data subject request process exists for access, portability, rectification, restriction, objection and verified erasure/anonymization.
- `[~] [P0]` Privacy notice and cookie notice versioning/publishing exists with public endpoint; still replace draft templates with legal-approved content before launch.
- `[~] [P0]` Encryption at rest and in transit verification attestations exist; still attach production infrastructure evidence and automated checks.
- `[~] [P0]` Database backup encryption and restore access control attestations exist; still add live backup/restore drill evidence from production-like infrastructure.
- `[~] [P0]` Audit log retention policy and tamper-evidence strategy exist; still backfill historical audit hashes and add WORM/export/archive evidence.
- `[~] [P1]` Regional data residency policies exist as draft/admin-managed controls; still activate per jurisdiction after hosting/provider validation.

## 12. Infrastructure And Runtime

- `[~] [P0]` Docker files, staging compose smoke tooling, remote runtime compose and container healthcheck binary exist; Docker daemon smoke checks were not available in the current environment.
- `[x] [GATE] [P0]` Production hosting architecture, network segmentation and private service access gates are documented and enforced for preprod/production config.
- `[x] [P0]` API TLS/reverse-proxy mode is enforced by config, and `/metrics` has internal CIDR allowlist enforcement plus reverse-proxy example rules.
- `[~] [P0]` Production-grade PostgreSQL HA/PITR/restore-drill config gates exist; still attach real managed PostgreSQL and restore evidence under database/go-live gates.
- `[x] [P0]` Separate environments exist for development, staging, preprod and production.
- `[x] [P0]` Environment-specific config validation exists for production-like preprod/production runtime, security, database and observability settings.
- `[x] [P0]` Resource limits, autoscaling policy config and deployment healthchecks exist in runtime compose/Docker image.
- `[x] [P0]` Queue/worker infrastructure exists through a dedicated `/banking-worker` binary and remote worker profile for async settlement work.
- `[x] [P1]` CD and runtime config support rolling, blue-green and canary deployment strategies with manifest metadata and deploy-hook variables.

## 13. Database, Migrations, And Data Integrity

- `[x]` SQL migrations with schema migration tracking are present.
- `[~] [P0]` Startup migrations exist; production may need pipeline-run migrations instead.
- `[x] [P0]` Migration dry-run and rollback planning exists through `cmd/migration-plan`, checksum output, rollback-file enforcement, CI/CD checks, release-note fields and the production migration approval artifact.
- `[~] [P0]` Database backup/restore drill evidence model and runbook exist; still execute the first live production-like restore drill and attach evidence.
- `[x] [P0]` Database index review records and high-volume path indexes exist for transfers, settlement reports, inbound payments, audit events, sessions, card webhooks, crypto transactions and payment status events.
- `[x] [P0]` Financial state-machine transition tables, PostgreSQL triggers and payment status constraints exist for transfers, payment review, wallet adjustment requests, savings, cards, FX, crypto and inbound payments.
- `[x] [P0]` Deadlock/serialization retry classifier tests exist for transfers, FX, savings and admin wallet adjustment flows.
- `[x] [P1]` Archival strategy and policy records exist for audit, ledger, webhooks, provider reports, notifications and old sessions; first scheduled archive execution evidence remains a go-live operations item.

## 14. Observability, Incident Response, And DORA-Style Resilience

- `[x]` Basic `/metrics` endpoint exists.
- `[~] [GATE] [P0]` Grafana dashboard pack exists for API health, DB health, ledger postings, transfers, settlements, cards, KYC/AML, FX, auth and provider calls; still deploy it to live staging and wire real provider/business metric emitters.
- `[~] [P0]` Prometheus alert rules and Alertmanager routing exist with severity, owners, escalation routes and runbook links; still connect real on-call tooling and prove first live alert delivery.
- `[x] [P0]` Request correlation exists with `X-Request-ID`, `X-Correlation-ID`, W3C `traceparent`, response headers and outbound provider header injection helper.
- `[x] [P0]` Structured redacted logs include request IDs and trace IDs when `BANKING_STRUCTURED_LOGS_ENABLED=true`; preprod/production config requires this.
- `[x] [P0]` Incident runbooks exist for provider outage, settlement break, ledger imbalance, data breach, auth attack and card/webhook storm.
- `[x] [P0]` Major incident notification process exists for regulators, providers, customers and executive escalation.
- `[~] [P0]` Business continuity and disaster recovery runbook and test plan exist with config gate evidence reference; still execute first live restore/DR drill and attach evidence.
- `[~] [P1]` Chaos/failure injection scenarios exist for provider outages, ambiguous provider results, DB failover, DB latency, webhook replay storm and logging redaction; still execute scheduled staging/preprod drills.

## 15. Testing And Quality Gates

- `[x]` Go unit tests exist for several domains.
- `[x]` Frontend production build passes in the latest checked run.
- `[x]` Backend `go test ./...` and `go vet ./...` passed in the latest checked run.
- `[~] [P0]` E2E smoke harness exists and can verify seeded staging login/account access; live Docker/API smoke was not run because Docker Desktop was unavailable.
- `[~] [GATE] [P0]` GitHub Actions CI runs backend tests, PostgreSQL integration tests, migration plan rollback coverage, migration runner, go vet, frontend build, Playwright browser e2e/accessibility checks, backend Docker image build, dependency review, govulncheck, npm audit, Gitleaks and Trivy image scanning. CD repeats release security gates, publishes signed API images with provenance, frontend artifacts, migration plans, migration approval records and deployment manifests; still configure hosted environment approvals, lint, SAST/code scanning and first successful hosted release evidence.
- `[~] [P0]` PostgreSQL integration tests exist for migrated schema, internal transfer money movement, webhook idempotency and ledger invariants; expand live contention tests for deadlock/serialization and additional product paths.
- `[~] [P0]` Ledger invariant tests cover balanced journals, account balances vs ledger, wallet available balances, reserved savings balances, high-volume validation and FX rounding vectors; expand coverage to no-negative edge cases and destructive restore/archive drills.
- `[x] [P0]` API contract tests from OpenAPI exist and verify documented path/method coverage plus declared responses.
- `[x] [P0]` Browser e2e tests cover login, MFA setup, transfer step-up, FX conversion, admin approval, settlement dashboard and customer/admin navigation on desktop and mobile.
- `[x] [P0]` Opt-in load tests cover health/auth/account list/transfers/cards/admin dashboard and signed webhook paths when `BANKING_LOAD_BASE_URL` is set; still run against staging with agreed SLO thresholds before launch.
- `[x] [P0]` Webhook replay/idempotency integration tests cover card webhook dedupe, KYC provider decision replay and idempotent transfer posting.
- `[x] [P1]` Axe-based accessibility checks cover login and admin shell workflows on desktop and mobile for critical violations.

## 16. CI/CD And Release Management

- `[~] [GATE] [P0]` Add source-control protected branches and required checks. Recommended rules are documented, but must be enabled in GitHub settings or API.
- `[x]` Automated build artifacts exist for backend API images, frontend dist bundles and deployment manifests.
- `[x] [P0]` Signed container images and artifact provenance exist through keyless Cosign signing, BuildKit provenance/SBOM and GitHub build-provenance attestations in CD.
- `[~] [P0]` Deploy pipeline exists with GitHub Environments and optional SSH deploy hook; configure staging/production environments, secrets, reviewers and remote hosts.
- `[x] [P0]` Production migration approval step exists through the `production-migration-approval` CD job, generated migration-plan artifact, approval artifact and required workflow inputs for manual production dispatches.
- `[~] [P0]` API image rollback is supported by manual CD `rollback_image`; still add frontend and database rollback procedures.
- `[x] [P0]` Release notes template exists with risk, migrations, toggles, verification, approvals and runbook links.
- `[x] [P1]` Feature flags for high-risk product features exist for payments, cards, FX, crypto, savings and admin money movement, with API route gates and remote deployment defaults.

## 17. Admin Operations And Backoffice

- `[x]` Admin dashboard exists with users, compliance queue, settlement dashboard, reconciliation, risk limits/events, login security events, routing-code contract rules, wallet adjustments, and ledger drill-down.
- `[x]` Wallet balance adjustments require four-eyes approval.
- `[x] [P0]` Maker-checker exists for FX rates, admin role changes and high-risk config changes.
- `[x] [P0]` Admin action export and evidence package endpoints exist for audits.
- `[x] [P0]` Operational queues exist for reconciliation breaks, manual payment review, fraud review, provider incidents and customer complaints.
- `[x] [P0]` Admin notes, attachment references, assignment, SLA and status history exist for backoffice cases.
- `[x] [P0]` Customer support impersonation rules exist as time-limited audited view sessions without exposing secrets or bypassing audit.
- `[x] [P1]` Role-specific dashboards exist for compliance, finance, support and operations.

## 18. Frontend And Customer Experience

- `[x]` React/TypeScript frontend includes overview, payments, accounts, cards, savings, crypto, security, and admin.
- `[x]` Refresh-token renewal and logout/session handling exist.
- `[x] [P0]` Step-up UX exists through a global modal triggered by API `step_up_required` responses and backed by `/v1/auth/step-up`.
- `[x] [P0]` Customer disclosures exist for payment screening/execution timing, FX rate/fee/spread/expiry, card authorization/tokenization terms, savings caveats, crypto risks and stablecoin/custody caveats.
- `[x] [P0]` Robust empty, error and loading states exist for critical admin dashboard flows, including settlement, payment review and top-level async admin failures.
- `[x] [P0]` Frontend e2e coverage exists for login, MFA setup, transfer with step-up response, FX quote/conversion, admin approval and settlement dashboard on desktop and mobile.
- `[x] [P1]` Accessibility review and keyboard navigation checks exist through Axe-based tests and keyboard activation coverage for primary navigation.
- `[x] [P1]` Localized content review record exists for `nl-NL`, including currency/date formatting, product term glossary notes and target-market review gates.

## 19. Documentation, Policies, And Training

- `[x]` Backend README and OpenAPI exist.
- `[x]` This production-readiness checklist exists.
- `[x] [P0]` Architecture, network trust boundaries, data classification, sources of truth and authentication, money, webhook, card, FX, crypto and admin data-flow diagrams exist.
- `[x] [P0]` Threat model covers authentication, money movement, webhooks, admin, cards, crypto/stablecoins and FX with assets, invariants, abuse cases, controls, residual owners and evidence requirements.
- `[x] [P0]` Runbooks cover deploy, application/frontend/database rollback, reconciliation breaks, provider outage, settlement break, ledger imbalance, incident response, data breach, auth attack, card/webhook storm, major incident notification, BCDR, database migration release and database backup/restore drills.
- `[x] [P0]` Compliance procedures cover KYC, EDD, AML, sanctions/PEP/adverse media, fraud, complaints, case evidence, suspicious-activity escalation and restricted SAR/STR workflow.
- `[x] [P0]` Customer support playbooks cover authentication, payments, cards, balances, KYC, FX, crypto, outages, privacy/security and complaints with prohibited-data and escalation rules.
- `[x] [P1]` Role-based onboarding and training material covers support, compliance/risk, finance, operations and privileged engineering, including assessment, supervised access, drills and recertification.

## 20. Go-Live Gates

### Gate A: Staging Launch

- `[~]` Docker/API staging smoke scripts and compose config exist; first clean-environment pass is still pending.
- `[~]` CI workflow is configured for backend tests, vet, migration plan rollback coverage, frontend build, frontend e2e/accessibility checks and migration-runner-backed PostgreSQL integration tests; CD workflow is configured for migration-plan/approval artifacts, artifact publish and optional SSH deploy, but first hosted CI/CD evidence is still pending.
- `[~]` Staging non-default secret gate exists in `go_live_gate_controls` and production-like config requires `BANKING_GO_LIVE_STAGING_SECRETS_REFERENCE`; still attach live staging secret-manager/config evidence.
- `[~]` Provider webhook end-to-end gate exists for signature, replay, ordering and idempotency evidence; still run and attach live staging provider webhook evidence.
- `[~]` Staging dashboards and alerts have deployable Prometheus/Grafana/Alertmanager config and compose files; first live staging deployment evidence is still pending.
- `[~]` Seeded test-user coverage gate exists for customer, admin, KYC, AML, wallet, cards, SEPA, crypto, savings and FX; still attach staging seed output and flow matrix evidence.

### Gate B: Closed Beta With Test Money Only

- `[~]` Gate A completion gate exists and depends on items 133-136; still approve or formally waive all Gate A evidence before beta.
- `[~]` CI/CD release and rollback exercise gate exists with required production-like config reference; still attach first hosted release/rollback exercise evidence.
- `[~]` Security scanning active gate exists and config requires scan evidence; still attach current CI security scan reports and thresholds.
- `[~]` Beta legal wording gate exists for test-money and non-bank wording; still attach counsel-approved customer copy.
- `[~]` Support and incident channel gate exists; still attach live support, complaint, security incident and major incident channel evidence.
- `[~]` Known-risk register approval gate exists; still attach product, engineering, security and compliance approval evidence.

### Gate C: Real-Money Production

- `[~] [GATE]` Legal/licensing model approval gate exists and config requires `BANKING_GO_LIVE_LEGAL_LICENSING_APPROVAL_REFERENCE`; still attach counsel/regulatory evidence per target jurisdiction.
- `[~] [GATE]` Real provider production approval gate exists and config requires provider production evidence; still attach signed contracts, credentials, certification packs and provider approval.
- `[~] [GATE]` Reconciliation and break-management live gate exists; still attach live provider balance feeds, finance ownership and break SLA evidence.
- `[~] [GATE]` Ledger invariant and PostgreSQL integration tests are configured in CI; require first successful hosted CI run and expanded money movement coverage.
- `[~] [GATE]` Security review, penetration-test and remediation gate exists; still attach external test, remediation and retest evidence.
- `[~] [GATE]` KYC/AML/sanctions/fraud operations live gate exists; still attach provider readiness, team ownership, escalation and regulatory-reporting evidence.
- `[~] [GATE]` DORA-style ICT risk, incident reporting, third-party risk and resilience approval gate exists; still complete formal signoff if EU financial regulation applies.
- `[~] [GATE]` PCI DSS scope and validation path gate exists; still attach issuer/acquirer/QSA-aligned PCI scope and validation evidence if cardholder data is handled.
- `[~] [GATE]` Backup, restore drill, DR plan and incident-runbook evidence gate exists; still attach production-like restore/DR/incident drill evidence.
- `[~] [GATE]` Executive go/no-go signoff gate exists and approved status requires approver name plus evidence; still record final accountable executive decision.

## Official Reference Links

- De Nederlandsche Bank payment services authorisation requirement: https://www.dnb.nl/en/sector-information/open-book-supervision/open-book-supervision-sectors/payment-institutions/licensing-requirement-for-payment-service-providers-overview/provision-of-payment-services/
- De Nederlandsche Bank payment service provider register: https://www.dnb.nl/en/public-register/register-of-payment-service-providers/
- Dutch Payments Association on issuing Dutch IBANs: https://www.betaalvereniging.nl/en/knowledge-base/iban-and-bic/issuing-dutch-ibans/
- European Commission DORA information: https://finance.ec.europa.eu/digital-finance/cyber-resilience_en
- EBA ICT and security risk management guidelines: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-ict-and-security-risk-management
- European Commission GDPR/data protection: https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en
- PCI Security Standards Council standards: https://www.pcisecuritystandards.org/standards/
- New York DFS money transmitter licensing example: https://www.dfs.ny.gov/apps_and_licensing/money_transmitters