PRM cheat sheet

Recovery Time Objective (RTO) is the maximum tolerable time to restore a function; Recovery Point Objective (RPO) is the maximum tolerable data loss measured in time. RPO drives backup frequency; RTO drives failover design.

Maximum Tolerable Downtime (MTD) = RTO + time to verify restoration and reconcile data; business impact analysis sets MTD first, then RTO must be strictly less than MTD.

Single Points of Failure (SPOF) analysis: map each critical business service to people, process, technology, and third-party dependencies; a service is only as resilient as its weakest unsubstituted dependency.

Impact tolerance is the level of disruption a firm can absorb before harm to clients, markets, or itself; UK-style operational resilience frameworks require mapping important business services to impact tolerances and scenario-testing them.

Residual risk = inherent risk x (1 - control effectiveness); controls are preventive, detective, or corrective, and detective controls reduce MTD only if alerting and escalation paths are tested.

RTO feasibility check: if RTO is shorter than the time to provision replacement infrastructure, the function must run on pre-provisioned warm or hot standby, not cold backup.

Concentration risk in outsourcing: two vendors on the same cloud region or the same upstream provider are effectively one dependency; assess fourth-party and nth-party risk, not just the primary contract.

Scenario testing must include severe-but-plausible events (loss of a site, loss of a key vendor, insider action, cyber ransom); test results feed back into RTO/RPO recalibration and control investment.

Incident severity classification drives escalation: define thresholds by customer impact, financial loss, and regulatory reporting triggers, and record decision logs for post-incident review.

Bias-variance tradeoff: expected error = bias^2 + variance + irreducible noise; high-complexity models lower bias and raise variance, so regularization (L1/L2, early stopping, pruning) trades variance for bias.

L1 regularization drives coefficients to exactly zero (feature selection); L2 shrinks coefficients smoothly toward zero; elastic net mixes both with ratio parameter alpha.

Classification metrics: precision = TP/(TP+FP), recall = TP/(TP+FN), F1 = 2PR/(P+R); ROC-AUC is threshold-independent but misleading under heavy class imbalance, where precision-recall AUC is preferred.

Cross-validation: k-fold estimates generalization error; use stratified k-fold for imbalanced classes and time-series split (expanding window) when observations are autocorrelated, never random shuffling.

Data leakage occurs when information from the target or the future enters training features (e.g., scaling before splitting, using post-event variables); it inflates validation scores and collapses in production.

Overfitting diagnostics: large gap between training and validation error, validation error rising while training error falls, and high sensitivity of results to a single data split.

Model risk management for ML requires documentation of purpose, data lineage, feature definitions, hyperparameter choices, validation results, and ongoing monitoring for drift.

Concept drift vs data drift: data drift is a change in input distribution P(X); concept drift is a change in the relationship P(Y|X); only concept drift necessarily degrades a stable model's accuracy.

Gradient boosting builds additive trees fitted to pseudo-residuals with learning rate shrinkage; random forest averages decorrelated trees via bootstrap sampling and random feature subsets, reducing variance.

Payment card economics: interchange is set by card network rules and regulation (e.g., caps on debit interchange), while merchant discount rate = interchange + scheme fees + acquirer margin.

Open banking APIs (PSD2-style) require Strong Customer Authentication with at least two independent factors from knowledge, possession, and inherence categories, plus dynamic linking of the authentication code to amount and payee.

Tokenization replaces a PAN with a surrogate token mapped in a token vault; it reduces PCI DSS scope because the merchant no longer stores the primary account number.

Settlement vs authorization: authorization reserves funds and expires; clearing and settlement move actual funds, so fraud and credit exposure differ between the two stages.

Real-time payments (instant credit transfer schemes) are irrevocable and near-instant, so fraud controls must shift from post-hoc chargeback recovery to pre-transaction scoring and beneficiary confirmation.

Distributed ledger settlement finality depends on consensus rules; probabilistic finality (proof-of-work) means a transaction can be reorganized, so confirmation depth is a risk parameter.

Regulatory perimeter for fintech: lending, payments, e-money, and crypto-asset activities each carry distinct licensing, capital, safeguarding, and AML/KYC obligations that vary by jurisdiction.

Third-party and cloud concentration risk in fintech: regulators expect exit plans, data portability, and audit rights for critical outsourced services, including sub-outsourcers.

Value at Risk (VaR) at confidence c over horizon h is the loss quantile: P(Loss > VaR) = 1 - c; parametric VaR = z_c x sigma x sqrt(h) - mu x h under normality.

Expected Shortfall (ES) = E[Loss | Loss > VaR]; it is subadditive and coherent, unlike VaR, so it captures tail severity and is preferred under Basel market-risk frameworks.

Duration approximates bond price sensitivity: percentage price change ≈ -D_mod x change in yield, with convexity adding +0.5 x C x (change in yield)^2 for larger moves.

Credit risk expected loss = PD x LGD x EAD; unexpected loss is driven by correlation and is covered by economic capital, while expected loss is covered by pricing and provisions.

Liquidity risk: Liquidity Coverage Ratio = high-quality liquid assets / net cash outflows over 30 days; Net Stable Funding Ratio = available stable funding / required stable funding over one year.

Market risk sensitivities: delta = dV/dS, gamma = d^2V/dS^2, vega = dV/d(sigma), theta = dV/dt; gamma and vega are largest near the money and near expiry for options.

Stress testing complements VaR because VaR says nothing about losses beyond the quantile; scenario shocks should be severe but plausible and applied to correlated risk factors jointly.

Risk aggregation requires recognizing diversification benefit: portfolio VaR is less than the sum of standalone VaRs unless correlations are 1; correlation assumptions break down in crises.

Basel capital structure: Common Equity Tier 1, Additional Tier 1, and Tier 2, with minimum ratios plus capital conservation and countercyclical buffers; leverage ratio is a non-risk-weighted backstop.

Recovery Time Objective (RTO) is the maximum tolerable time to restore a function; Recovery Point Objective (RPO) is the maximum tolerable data loss measured in time. RPO drives backup frequency; RTO drives failover design.

Maximum Tolerable Downtime (MTD) = RTO + time to verify restoration and reconcile data; business impact analysis sets MTD first, then RTO must be strictly less than MTD.

Single Points of Failure (SPOF) analysis: map each critical business service to people, process, technology, and third-party dependencies; a service is only as resilient as its weakest unsubstituted dependency.

Impact tolerance is the level of disruption a firm can absorb before harm to clients, markets, or itself; UK-style operational resilience frameworks require mapping important business services to impact tolerances and scenario-testing them.

Residual risk = inherent risk x (1 - control effectiveness); controls are preventive, detective, or corrective, and detective controls reduce MTD only if alerting and escalation paths are tested.

RTO feasibility check: if RTO is shorter than the time to provision replacement infrastructure, the function must run on pre-provisioned warm or hot standby, not cold backup.

Concentration risk in outsourcing: two vendors on the same cloud region or the same upstream provider are effectively one dependency; assess fourth-party and nth-party risk, not just the primary contract.

Scenario testing must include severe-but-plausible events (loss of a site, loss of a key vendor, insider action, cyber ransom); test results feed back into RTO/RPO recalibration and control investment.

Incident severity classification drives escalation: define thresholds by customer impact, financial loss, and regulatory reporting triggers, and record decision logs for post-incident review.

Bias-variance tradeoff: expected error = bias^2 + variance + irreducible noise; high-complexity models lower bias and raise variance, so regularization (L1/L2, early stopping, pruning) trades variance for bias.

L1 regularization drives coefficients to exactly zero (feature selection); L2 shrinks coefficients smoothly toward zero; elastic net mixes both with ratio parameter alpha.

Classification metrics: precision = TP/(TP+FP), recall = TP/(TP+FN), F1 = 2PR/(P+R); ROC-AUC is threshold-independent but misleading under heavy class imbalance, where precision-recall AUC is preferred.

Cross-validation: k-fold estimates generalization error; use stratified k-fold for imbalanced classes and time-series split (expanding window) when observations are autocorrelated, never random shuffling.

Data leakage occurs when information from the target or the future enters training features (e.g., scaling before splitting, using post-event variables); it inflates validation scores and collapses in production.

Overfitting diagnostics: large gap between training and validation error, validation error rising while training error falls, and high sensitivity of results to a single data split.

Model risk management for ML requires documentation of purpose, data lineage, feature definitions, hyperparameter choices, validation results, and ongoing monitoring for drift.

Concept drift vs data drift: data drift is a change in input distribution P(X); concept drift is a change in the relationship P(Y|X); only concept drift necessarily degrades a stable model's accuracy.

Gradient boosting builds additive trees fitted to pseudo-residuals with learning rate shrinkage; random forest averages decorrelated trees via bootstrap sampling and random feature subsets, reducing variance.

Payment card economics: interchange is set by card network rules and regulation (e.g., caps on debit interchange), while merchant discount rate = interchange + scheme fees + acquirer margin.

Open banking APIs (PSD2-style) require Strong Customer Authentication with at least two independent factors from knowledge, possession, and inherence categories, plus dynamic linking of the authentication code to amount and payee.

Tokenization replaces a PAN with a surrogate token mapped in a token vault; it reduces PCI DSS scope because the merchant no longer stores the primary account number.

Settlement vs authorization: authorization reserves funds and expires; clearing and settlement move actual funds, so fraud and credit exposure differ between the two stages.

Real-time payments (instant credit transfer schemes) are irrevocable and near-instant, so fraud controls must shift from post-hoc chargeback recovery to pre-transaction scoring and beneficiary confirmation.

Distributed ledger settlement finality depends on consensus rules; probabilistic finality (proof-of-work) means a transaction can be reorganized, so confirmation depth is a risk parameter.

Regulatory perimeter for fintech: lending, payments, e-money, and crypto-asset activities each carry distinct licensing, capital, safeguarding, and AML/KYC obligations that vary by jurisdiction.

Third-party and cloud concentration risk in fintech: regulators expect exit plans, data portability, and audit rights for critical outsourced services, including sub-outsourcers.

Value at Risk (VaR) at confidence c over horizon h is the loss quantile: P(Loss > VaR) = 1 - c; parametric VaR = z_c x sigma x sqrt(h) - mu x h under normality.

Expected Shortfall (ES) = E[Loss | Loss > VaR]; it is subadditive and coherent, unlike VaR, so it captures tail severity and is preferred under Basel market-risk frameworks.

Duration approximates bond price sensitivity: percentage price change ≈ -D_mod x change in yield, with convexity adding +0.5 x C x (change in yield)^2 for larger moves.

Credit risk expected loss = PD x LGD x EAD; unexpected loss is driven by correlation and is covered by economic capital, while expected loss is covered by pricing and provisions.

Liquidity risk: Liquidity Coverage Ratio = high-quality liquid assets / net cash outflows over 30 days; Net Stable Funding Ratio = available stable funding / required stable funding over one year.

Market risk sensitivities: delta = dV/dS, gamma = d^2V/dS^2, vega = dV/d(sigma), theta = dV/dt; gamma and vega are largest near the money and near expiry for options.

Stress testing complements VaR because VaR says nothing about losses beyond the quantile; scenario shocks should be severe but plausible and applied to correlated risk factors jointly.

Risk aggregation requires recognizing diversification benefit: portfolio VaR is less than the sum of standalone VaRs unless correlations are 1; correlation assumptions break down in crises.

Basel capital structure: Common Equity Tier 1, Additional Tier 1, and Tier 2, with minimum ratios plus capital conservation and countercyclical buffers; leverage ratio is a non-risk-weighted backstop.

Recovery Time Objective (RTO) is the maximum tolerable time to restore a function; Recovery Point Objective (RPO) is the maximum tolerable data loss measured in time. RPO drives backup frequency; RTO drives failover design.

Maximum Tolerable Downtime (MTD) = RTO + time to verify restoration and reconcile data; business impact analysis sets MTD first, then RTO must be strictly less than MTD.

Single Points of Failure (SPOF) analysis: map each critical business service to people, process, technology, and third-party dependencies; a service is only as resilient as its weakest unsubstituted dependency.

Impact tolerance is the level of disruption a firm can absorb before harm to clients, markets, or itself; UK-style operational resilience frameworks require mapping important business services to impact tolerances and scenario-testing them.

Residual risk = inherent risk x (1 - control effectiveness); controls are preventive, detective, or corrective, and detective controls reduce MTD only if alerting and escalation paths are tested.

RTO feasibility check: if RTO is shorter than the time to provision replacement infrastructure, the function must run on pre-provisioned warm or hot standby, not cold backup.

Concentration risk in outsourcing: two vendors on the same cloud region or the same upstream provider are effectively one dependency; assess fourth-party and nth-party risk, not just the primary contract.

Scenario testing must include severe-but-plausible events (loss of a site, loss of a key vendor, insider action, cyber ransom); test results feed back into RTO/RPO recalibration and control investment.

Incident severity classification drives escalation: define thresholds by customer impact, financial loss, and regulatory reporting triggers, and record decision logs for post-incident review.

Bias-variance tradeoff: expected error = bias^2 + variance + irreducible noise; high-complexity models lower bias and raise variance, so regularization (L1/L2, early stopping, pruning) trades variance for bias.

L1 regularization drives coefficients to exactly zero (feature selection); L2 shrinks coefficients smoothly toward zero; elastic net mixes both with ratio parameter alpha.

Classification metrics: precision = TP/(TP+FP), recall = TP/(TP+FN), F1 = 2PR/(P+R); ROC-AUC is threshold-independent but misleading under heavy class imbalance, where precision-recall AUC is preferred.

Cross-validation: k-fold estimates generalization error; use stratified k-fold for imbalanced classes and time-series split (expanding window) when observations are autocorrelated, never random shuffling.

Data leakage occurs when information from the target or the future enters training features (e.g., scaling before splitting, using post-event variables); it inflates validation scores and collapses in production.

Overfitting diagnostics: large gap between training and validation error, validation error rising while training error falls, and high sensitivity of results to a single data split.

Model risk management for ML requires documentation of purpose, data lineage, feature definitions, hyperparameter choices, validation results, and ongoing monitoring for drift.

Concept drift vs data drift: data drift is a change in input distribution P(X); concept drift is a change in the relationship P(Y|X); only concept drift necessarily degrades a stable model's accuracy.

Gradient boosting builds additive trees fitted to pseudo-residuals with learning rate shrinkage; random forest averages decorrelated trees via bootstrap sampling and random feature subsets, reducing variance.

Payment card economics: interchange is set by card network rules and regulation (e.g., caps on debit interchange), while merchant discount rate = interchange + scheme fees + acquirer margin.

Open banking APIs (PSD2-style) require Strong Customer Authentication with at least two independent factors from knowledge, possession, and inherence categories, plus dynamic linking of the authentication code to amount and payee.

Tokenization replaces a PAN with a surrogate token mapped in a token vault; it reduces PCI DSS scope because the merchant no longer stores the primary account number.

Settlement vs authorization: authorization reserves funds and expires; clearing and settlement move actual funds, so fraud and credit exposure differ between the two stages.

Real-time payments (instant credit transfer schemes) are irrevocable and near-instant, so fraud controls must shift from post-hoc chargeback recovery to pre-transaction scoring and beneficiary confirmation.

Distributed ledger settlement finality depends on consensus rules; probabilistic finality (proof-of-work) means a transaction can be reorganized, so confirmation depth is a risk parameter.

Regulatory perimeter for fintech: lending, payments, e-money, and crypto-asset activities each carry distinct licensing, capital, safeguarding, and AML/KYC obligations that vary by jurisdiction.

Third-party and cloud concentration risk in fintech: regulators expect exit plans, data portability, and audit rights for critical outsourced services, including sub-outsourcers.

Value at Risk (VaR) at confidence c over horizon h is the loss quantile: P(Loss > VaR) = 1 - c; parametric VaR = z_c x sigma x sqrt(h) - mu x h under normality.

Expected Shortfall (ES) = E[Loss | Loss > VaR]; it is subadditive and coherent, unlike VaR, so it captures tail severity and is preferred under Basel market-risk frameworks.

Duration approximates bond price sensitivity: percentage price change ≈ -D_mod x change in yield, with convexity adding +0.5 x C x (change in yield)^2 for larger moves.

Credit risk expected loss = PD x LGD x EAD; unexpected loss is driven by correlation and is covered by economic capital, while expected loss is covered by pricing and provisions.

Liquidity risk: Liquidity Coverage Ratio = high-quality liquid assets / net cash outflows over 30 days; Net Stable Funding Ratio = available stable funding / required stable funding over one year.

Market risk sensitivities: delta = dV/dS, gamma = d^2V/dS^2, vega = dV/d(sigma), theta = dV/dt; gamma and vega are largest near the money and near expiry for options.

Stress testing complements VaR because VaR says nothing about losses beyond the quantile; scenario shocks should be severe but plausible and applied to correlated risk factors jointly.

Risk aggregation requires recognizing diversification benefit: portfolio VaR is less than the sum of standalone VaRs unless correlations are 1; correlation assumptions break down in crises.

Basel capital structure: Common Equity Tier 1, Additional Tier 1, and Tier 2, with minimum ratios plus capital conservation and countercyclical buffers; leverage ratio is a non-risk-weighted backstop.

Recovery Time Objective (RTO) is the maximum tolerable time to restore a function; Recovery Point Objective (RPO) is the maximum tolerable data loss measured in time. RPO drives backup frequency; RTO drives failover design.

Maximum Tolerable Downtime (MTD) = RTO + time to verify restoration and reconcile data; business impact analysis sets MTD first, then RTO must be strictly less than MTD.

Single Points of Failure (SPOF) analysis: map each critical business service to people, process, technology, and third-party dependencies; a service is only as resilient as its weakest unsubstituted dependency.

Impact tolerance is the level of disruption a firm can absorb before harm to clients, markets, or itself; UK-style operational resilience frameworks require mapping important business services to impact tolerances and scenario-testing them.

Residual risk = inherent risk x (1 - control effectiveness); controls are preventive, detective, or corrective, and detective controls reduce MTD only if alerting and escalation paths are tested.

RTO feasibility check: if RTO is shorter than the time to provision replacement infrastructure, the function must run on pre-provisioned warm or hot standby, not cold backup.

Concentration risk in outsourcing: two vendors on the same cloud region or the same upstream provider are effectively one dependency; assess fourth-party and nth-party risk, not just the primary contract.

Scenario testing must include severe-but-plausible events (loss of a site, loss of a key vendor, insider action, cyber ransom); test results feed back into RTO/RPO recalibration and control investment.

Incident severity classification drives escalation: define thresholds by customer impact, financial loss, and regulatory reporting triggers, and record decision logs for post-incident review.

Bias-variance tradeoff: expected error = bias^2 + variance + irreducible noise; high-complexity models lower bias and raise variance, so regularization (L1/L2, early stopping, pruning) trades variance for bias.

L1 regularization drives coefficients to exactly zero (feature selection); L2 shrinks coefficients smoothly toward zero; elastic net mixes both with ratio parameter alpha.

Classification metrics: precision = TP/(TP+FP), recall = TP/(TP+FN), F1 = 2PR/(P+R); ROC-AUC is threshold-independent but misleading under heavy class imbalance, where precision-recall AUC is preferred.

Cross-validation: k-fold estimates generalization error; use stratified k-fold for imbalanced classes and time-series split (expanding window) when observations are autocorrelated, never random shuffling.

Data leakage occurs when information from the target or the future enters training features (e.g., scaling before splitting, using post-event variables); it inflates validation scores and collapses in production.

Overfitting diagnostics: large gap between training and validation error, validation error rising while training error falls, and high sensitivity of results to a single data split.

Model risk management for ML requires documentation of purpose, data lineage, feature definitions, hyperparameter choices, validation results, and ongoing monitoring for drift.

Concept drift vs data drift: data drift is a change in input distribution P(X); concept drift is a change in the relationship P(Y|X); only concept drift necessarily degrades a stable model's accuracy.

Gradient boosting builds additive trees fitted to pseudo-residuals with learning rate shrinkage; random forest averages decorrelated trees via bootstrap sampling and random feature subsets, reducing variance.

Payment card economics: interchange is set by card network rules and regulation (e.g., caps on debit interchange), while merchant discount rate = interchange + scheme fees + acquirer margin.

Open banking APIs (PSD2-style) require Strong Customer Authentication with at least two independent factors from knowledge, possession, and inherence categories, plus dynamic linking of the authentication code to amount and payee.

Tokenization replaces a PAN with a surrogate token mapped in a token vault; it reduces PCI DSS scope because the merchant no longer stores the primary account number.

Settlement vs authorization: authorization reserves funds and expires; clearing and settlement move actual funds, so fraud and credit exposure differ between the two stages.

Real-time payments (instant credit transfer schemes) are irrevocable and near-instant, so fraud controls must shift from post-hoc chargeback recovery to pre-transaction scoring and beneficiary confirmation.

Distributed ledger settlement finality depends on consensus rules; probabilistic finality (proof-of-work) means a transaction can be reorganized, so confirmation depth is a risk parameter.

Regulatory perimeter for fintech: lending, payments, e-money, and crypto-asset activities each carry distinct licensing, capital, safeguarding, and AML/KYC obligations that vary by jurisdiction.

Third-party and cloud concentration risk in fintech: regulators expect exit plans, data portability, and audit rights for critical outsourced services, including sub-outsourcers.

Value at Risk (VaR) at confidence c over horizon h is the loss quantile: P(Loss > VaR) = 1 - c; parametric VaR = z_c x sigma x sqrt(h) - mu x h under normality.

Expected Shortfall (ES) = E[Loss | Loss > VaR]; it is subadditive and coherent, unlike VaR, so it captures tail severity and is preferred under Basel market-risk frameworks.

Duration approximates bond price sensitivity: percentage price change ≈ -D_mod x change in yield, with convexity adding +0.5 x C x (change in yield)^2 for larger moves.

Credit risk expected loss = PD x LGD x EAD; unexpected loss is driven by correlation and is covered by economic capital, while expected loss is covered by pricing and provisions.

Liquidity risk: Liquidity Coverage Ratio = high-quality liquid assets / net cash outflows over 30 days; Net Stable Funding Ratio = available stable funding / required stable funding over one year.

Market risk sensitivities: delta = dV/dS, gamma = d^2V/dS^2, vega = dV/d(sigma), theta = dV/dt; gamma and vega are largest near the money and near expiry for options.

Stress testing complements VaR because VaR says nothing about losses beyond the quantile; scenario shocks should be severe but plausible and applied to correlated risk factors jointly.

Risk aggregation requires recognizing diversification benefit: portfolio VaR is less than the sum of standalone VaRs unless correlations are 1; correlation assumptions break down in crises.

Basel capital structure: Common Equity Tier 1, Additional Tier 1, and Tier 2, with minimum ratios plus capital conservation and countercyclical buffers; leverage ratio is a non-risk-weighted backstop.

Recovery Time Objective (RTO) is the maximum tolerable time to restore a function; Recovery Point Objective (RPO) is the maximum tolerable data loss measured in time. RPO drives backup frequency; RTO drives failover design.

Maximum Tolerable Downtime (MTD) = RTO + time to verify restoration and reconcile data; business impact analysis sets MTD first, then RTO must be strictly less than MTD.

Single Points of Failure (SPOF) analysis: map each critical business service to people, process, technology, and third-party dependencies; a service is only as resilient as its weakest unsubstituted dependency.

Impact tolerance is the level of disruption a firm can absorb before harm to clients, markets, or itself; UK-style operational resilience frameworks require mapping important business services to impact tolerances and scenario-testing them.

Residual risk = inherent risk x (1 - control effectiveness); controls are preventive, detective, or corrective, and detective controls reduce MTD only if alerting and escalation paths are tested.

RTO feasibility check: if RTO is shorter than the time to provision replacement infrastructure, the function must run on pre-provisioned warm or hot standby, not cold backup.

Concentration risk in outsourcing: two vendors on the same cloud region or the same upstream provider are effectively one dependency; assess fourth-party and nth-party risk, not just the primary contract.

Scenario testing must include severe-but-plausible events (loss of a site, loss of a key vendor, insider action, cyber ransom); test results feed back into RTO/RPO recalibration and control investment.

Incident severity classification drives escalation: define thresholds by customer impact, financial loss, and regulatory reporting triggers, and record decision logs for post-incident review.

Bias-variance tradeoff: expected error = bias^2 + variance + irreducible noise; high-complexity models lower bias and raise variance, so regularization (L1/L2, early stopping, pruning) trades variance for bias.

L1 regularization drives coefficients to exactly zero (feature selection); L2 shrinks coefficients smoothly toward zero; elastic net mixes both with ratio parameter alpha.

Classification metrics: precision = TP/(TP+FP), recall = TP/(TP+FN), F1 = 2PR/(P+R); ROC-AUC is threshold-independent but misleading under heavy class imbalance, where precision-recall AUC is preferred.

Cross-validation: k-fold estimates generalization error; use stratified k-fold for imbalanced classes and time-series split (expanding window) when observations are autocorrelated, never random shuffling.

Data leakage occurs when information from the target or the future enters training features (e.g., scaling before splitting, using post-event variables); it inflates validation scores and collapses in production.

Overfitting diagnostics: large gap between training and validation error, validation error rising while training error falls, and high sensitivity of results to a single data split.

Model risk management for ML requires documentation of purpose, data lineage, feature definitions, hyperparameter choices, validation results, and ongoing monitoring for drift.

Concept drift vs data drift: data drift is a change in input distribution P(X); concept drift is a change in the relationship P(Y|X); only concept drift necessarily degrades a stable model's accuracy.

Gradient boosting builds additive trees fitted to pseudo-residuals with learning rate shrinkage; random forest averages decorrelated trees via bootstrap sampling and random feature subsets, reducing variance.

Payment card economics: interchange is set by card network rules and regulation (e.g., caps on debit interchange), while merchant discount rate = interchange + scheme fees + acquirer margin.

Open banking APIs (PSD2-style) require Strong Customer Authentication with at least two independent factors from knowledge, possession, and inherence categories, plus dynamic linking of the authentication code to amount and payee.

Tokenization replaces a PAN with a surrogate token mapped in a token vault; it reduces PCI DSS scope because the merchant no longer stores the primary account number.

Settlement vs authorization: authorization reserves funds and expires; clearing and settlement move actual funds, so fraud and credit exposure differ between the two stages.

Real-time payments (instant credit transfer schemes) are irrevocable and near-instant, so fraud controls must shift from post-hoc chargeback recovery to pre-transaction scoring and beneficiary confirmation.

Distributed ledger settlement finality depends on consensus rules; probabilistic finality (proof-of-work) means a transaction can be reorganized, so confirmation depth is a risk parameter.

Regulatory perimeter for fintech: lending, payments, e-money, and crypto-asset activities each carry distinct licensing, capital, safeguarding, and AML/KYC obligations that vary by jurisdiction.

Third-party and cloud concentration risk in fintech: regulators expect exit plans, data portability, and audit rights for critical outsourced services, including sub-outsourcers.

Value at Risk (VaR) at confidence c over horizon h is the loss quantile: P(Loss > VaR) = 1 - c; parametric VaR = z_c x sigma x sqrt(h) - mu x h under normality.

Expected Shortfall (ES) = E[Loss | Loss > VaR]; it is subadditive and coherent, unlike VaR, so it captures tail severity and is preferred under Basel market-risk frameworks.

Duration approximates bond price sensitivity: percentage price change ≈ -D_mod x change in yield, with convexity adding +0.5 x C x (change in yield)^2 for larger moves.

Credit risk expected loss = PD x LGD x EAD; unexpected loss is driven by correlation and is covered by economic capital, while expected loss is covered by pricing and provisions.

Liquidity risk: Liquidity Coverage Ratio = high-quality liquid assets / net cash outflows over 30 days; Net Stable Funding Ratio = available stable funding / required stable funding over one year.

Market risk sensitivities: delta = dV/dS, gamma = d^2V/dS^2, vega = dV/d(sigma), theta = dV/dt; gamma and vega are largest near the money and near expiry for options.

Stress testing complements VaR because VaR says nothing about losses beyond the quantile; scenario shocks should be severe but plausible and applied to correlated risk factors jointly.

Risk aggregation requires recognizing diversification benefit: portfolio VaR is less than the sum of standalone VaRs unless correlations are 1; correlation assumptions break down in crises.

Basel capital structure: Common Equity Tier 1, Additional Tier 1, and Tier 2, with minimum ratios plus capital conservation and countercyclical buffers; leverage ratio is a non-risk-weighted backstop.