The problems banks bring us, and how we take them on.
Banks bring us six jobs, end to end. Each one runs on the same governed knowledge graph, so solving the first makes the second cheaper, and every one of them leaves proof behind.
Regulatory reporting you can stand behind
Every number on a regulatory report traces to its sources, the controls around it run continuously, and posture is computed per principle. The exam file becomes a byproduct of operating, not a separate assembly effort.
- Column-level traceability from report line to source, read from real code
- Posture per principle, computed live: failing means failing, uncovered means uncovered
- A sealed exam file your second line can drill before the examiner arrives
- Change control on every critical field feeding the report
The bank's board and senior management govern how risk data is aggregated and reported, with clear accountability.
Click for the full picture →
Data architecture and IT infrastructure fully support aggregation and reporting, in normal times and in stress.
Click for the full picture →
Risk data is accurate and reliable, aggregated on a largely automated basis to minimize the chance of error.
Click for the full picture →
The bank captures and aggregates all material risk data across the group. Exceptions are identified and explained.
Click for the full picture →
The bank can produce up-to-date aggregated risk data quickly, including in stress and crisis situations.
Click for the full picture →
The bank can meet ad-hoc and supervisory requests for risk data, including during stress.
Click for the full picture →
Risk reports precisely convey aggregated data, and are reconciled and validated.
Click for the full picture →
Reports cover all material risk areas, with depth that matches the bank's size and complexity.
Click for the full picture →
Reports are clear, concise, and tailored to what their recipients need to make decisions.
Click for the full picture →
Reports are produced as often as recipients need, and faster in stress.
Click for the full picture →
Reports reach the right people while confidentiality is preserved.
Click for the full picture →
Supervisors periodically review the bank's compliance with the principles.
Click for the full picture →
Supervisors require and monitor effective and timely remediation.
Click for the full picture →
Home and host supervisors cooperate and share information across jurisdictions.
Click for the full picture →
BCBS 239 is the Basel Committee's standard for risk data aggregation and risk reporting. It was issued after the financial crisis showed that banks could not see their own exposures fast enough, and supervisors examine against it. Principles 3 to 11 cover how risk data is aggregated and reported in daily operation.
The bank captures and aggregates all material risk data across the group. Exceptions are identified and explained.
Principle 4 fails quietly, because data you never captured leaves no error message. OntaVera's automated discovery across the connector library inventories what actually exists across the group, and coverage gaps appear as explicit failures rather than blank spaces. Volume and schema monitors then catch feeds that drop or shrink, so every exception to completeness is identified and explained by you instead of discovered by a supervisor.
In this illustration: One feeder system's coverage dropped below threshold on Tuesday. The principle reads failing until the rerun proves otherwise, which is the point.
Hover any principle to see what it asks. Click it for the full picture, including how OntaVera takes it on. Failing means failing and uncovered means uncovered, because green here can only be earned.
Evidence in minutes, not weeks
When audit or the regulator asks, the proof already exists. Evidence packs generate from the sealed record and live lineage, and any point in time can be reconstructed: what was known, when, and who decided.
- Exam-ready evidence packs generated on demand, reproducible by your second line
- Point-in-time reconstruction of any decision, with the sign-off trail attached
- Attestations recorded and sealed: who signed and what they saw
- One exam workspace for requests, responses, and artifacts
Critical data, under control
The fields your reports and decisions actually ride on get found, tiered, owned, and bound to the checks that prove they're fit for use. When an attestation lapses, it shows.
- CDEs discovered and scored with evidence drawn from the systems themselves
- One registry, tiered by materiality, every entry with a named owner
- Attestations on a schedule; changes through the decision door
- Roll-ups from report line down to source columns
Catch breaks before your reports do
Rules and monitors run where your data lives, anomalies get flagged upstream, and incidents open with the affected reports already mapped. Closure requires a verified re-check, so a failed issue stays open until the fix is proven.
- Rules in plain language or SQL, simulated before they run, approved maker-checker
- Freshness, volume, schema, and drift monitoring with quality SLOs per dataset
- Anomaly detection for the breaks nobody wrote a rule for
- Verified closure: a re-check proves the fix, confirmed by someone who didn't make it
- Discovery and classification with the evidence shown, human gate before labels bind
- Labels that travel with lineage, so downstream copies inherit the handling
- Policy-based access with grants that actually expire
- Retention and disposal with proof, including legal holds
AI your risk team can sign off on
Models, agents, and prompts are governed as first-class assets on the same graph as your data: inventoried, evaluated, monitored, and stoppable. Every run lands on a record the agent can't touch.
- One registry for every model, agent, and prompt, each with an owner and a tier
- Evaluation and red teaming before anything serves, results on the record
- Human checkpoints on consequential actions; a kill switch at three scopes
- Run records sealed like every other decision, replayable for your examiner
Live in ninety days, with every step earned.
The first 90 days run on a budget line you already have: regulatory reporting. We start with five source systems, one priority report, and your first evidence pack from your own lineage. More scope moves the date, and we tell you by how much before you sign.
Prove it
You start with one priority report, five source systems, and your first evidence pack built from your own lineage, all on the regulatory-reporting budget you already have.
Extend
You add more reports, more domains, and more of the platform, with each step behind an exit gate you approve before the next dollar is spent.
Scale
Governed data is published as products, and your AI models, agents, and prompts are governed on the record the rest of the bank already trusts.
Your baseline and your numbers: no vendor math.
In the first 90 days we capture your baselines: hours per evidence request, time to find trusted data, incidents reaching reports. Then we set targets together, track them in the product, and review them with you every quarter.
“Value lives on a dashboard, not in a deck. If your baseline does not move, the renewal conversation should be hard for us, not for you.”
Audit, exam, and attestation requests all count. Include the chasing and re-checking in the hours, since that is usually where most of them hide.
This is illustrative arithmetic, not a promise. In your first 90 days we capture your actual baseline and track it in the product, with no industry averages and no vendor math.
Start with proof, not a promise.
There are three ways in, and each one earns the next. You approve the exit criteria before we spend any more of your time or budget.
A 60-minute working session
Bring one report that is expensive to prove. We walk the mechanism against it. Nothing is required from your side.
A two-week guided sandbox
Your team works hands-on against a synthetic sample bank. It requires zero access to your systems and zero procurement.
A six-week proof on your systems
We use read-only metadata across five systems and one priority report, scored against criteria both sides sign first. The decision it produces is yours.