Fasil PM logoFasil PMProject & IT ConsultancyBook a call

Absorbing Everything Is Not How You Keep a Regulator. Or a Budget.

What happens when the next request lands after a rejected proposal, and why absorbing it quietly costs more than raising the change would have.

Programme
Project Falcon
Organisation
Atlas Bank
Phase
Execution
Template
Change Request
Post 13 of 22 following Project Falcon at Atlas Bank. Full program context is in Post 01. Previously, Post 12 documented ADR-001: a technically correct architecture proposal, formally REJECTED, with the reasoning preserved for the day someone asks why. This post is what happens when the next scope pressure arrives from outside the building, carrying a regulator's letterhead.

The Quarterly Briefing Was Routine. Until Item Four.

Month 8 of 18. Phase 2, Build and Integration, is past its midpoint and holding. Eleven of nineteen microservices are feature-complete in at least one market. The velocity wobble from Post 11 has settled since the RACI decomposition. ADR-001 is closed and filed. The contingency reserve stands where it stood in July: $328K unallocated, with the allocated buckets drawn per the register. The next steering committee is Thursday, 2 October, first Thursday of the month as always, chaired by Fatima Idris.

And it is quarterly briefing week. Post 07 established PMO-CC-002: a formal, minuted, quarterly regulatory briefing per market, created after an informal coffee between a vendor lead and a regulator nearly became a governance incident. The mechanism was designed to give regulators a structured channel so that nothing about Falcon reached them through side doors. Mechanisms like this are insurance. Most quarters, the premium feels expensive and nothing happens.

The Market C briefing convenes at 10:00 local time in the central bank's offices. Across the table: Olumide Adebayo, Director of Banking Supervision, Market C Central Bank. He has chaired all three of Falcon's quarterly briefings in his market. He is precise, courteous, and reads every pre-read in full, which Fasil Alemeye Abate learned in Q1 when Adebayo quoted paragraph numbers back at him.

Items one through three are progress, risk posture, and the certification runway for the March 2026 audit. Item four is new. Adebayo slides a document across the table.

Olumide Adebayo: “AML/CFT Directive 2025-04, Amendment 2, gazetted last week. Enhanced transaction monitoring on cross-border remittances, with real-time screening at a 200 millisecond service level. Effective 1 February 2026. We are briefing all licensed institutions this month. Given Falcon's go-live timeline, we thought it deserved a direct conversation rather than a circular.”

The date is the problem inside the problem. 1 February 2026 lands in the middle of Phase 3, UAT and Certification, which runs January through March. Whatever Falcon does about this directive, it does it while preparing for the certification audit the directive's own issuer will conduct. The two threads are now the same thread.

Fasil thanks Adebayo, confirms the program will respond through the formal channel within ten business days, and asks one question: whether the central bank distinguishes between the monitoring rule changes and the 200ms real-time screening requirement, or treats the amendment as indivisible. Adebayo's answer matters more than anything else said in the room.

Adebayo: “The monitoring provisions are mandatory at the effective date. The service level has a supervisory expectations period through Q2 2026. We expect a credible plan, not necessarily a finished system.”

That distinction is the seam the entire Change Request will be built along. The regulator did not ask for everything by February. The room, as Fasil is about to discover, heard everything.

The regulator asked for a credible plan. The building heard a deadline.

The Sponsor Wants to Absorb All of It

Fasil briefs Fatima Idris the same afternoon, before the summary email can reach her through anyone else. Her reaction is immediate and strategic, which is what makes it dangerous.

Fatima Idris: “We absorb it. All of it, the monitoring rules and the 200 millisecond requirement, inside the current budget and the current dates. I do not want Atlas Bank to be the institution that responded to a supervisory directive with a costed objection. The relationship with that office matters more than tolerance language right now.”

Idris is not wrong about the relationship. She is wrong about what protects it. Her instinct is the instinct of a sponsor who has watched banks lose certification fights over posture rather than substance. But “absorb everything quietly” has a cost structure she has not seen yet, and it converts the program's $14.2M baseline into a number that no longer describes anything. The next variance report would be explaining overruns against a budget that was silently re-scoped without a paper trail. In a regulated program, that is not flexibility. That is the audit finding.

Fasil's counter rests on the charter signed 2 February 2025, Day 19, with its three firm commitments and seven explicit tolerances. Tolerance T4 was written for precisely this morning:

Charter Tolerance T4 (signed 2 Feb 2025)

Post-charter regulatory change in any market is absorbed within the approved envelope up to USD 500K cumulative per market, funded from the allocated regulatory-change contingency bucket. Absorption beyond that threshold, or any change affecting a firm commitment date, requires a steering-approved Change Request.

The directive, fully absorbed, prices at $920K to $1.06M for Market C. T4 caps silent absorption at $500K. The math is not a negotiating position; it is a signature Idris herself put on the charter. Fasil's proposal: absorb the mandatory monitoring provisions ($340K, within T4, fully traceable) and take the 200ms screening build to steering on 2 October as a formal Change Request, exactly the credible plan Adebayo said his office expects.

Idris: “And if steering reads a Change Request as the program resisting a regulator?”
Fasil Alemeye Abate: “Then the Change Request has failed at its one job, and that is a writing problem, not a governance problem. The document will open with the regulator's own words: credible plan, not finished system. We are not declining the directive. We are pricing it, splitting it along the seam the regulator gave us, and asking the right authority level to fund the part that exceeds mine and yours combined.”

Idris does not concede in the meeting. She concedes two days later, on 27 September, after reading the draft CR with the tolerance trace and the cost table. What moved her was not the argument; it was seeing T4 cited by clause number with the drawdown ledger attached. The charter language she signed in February turned out to be the thing protecting her from her own instinct in September.

A tolerance you never cite is a tolerance you never had.

200 Milliseconds, Two Paths, One Contract Clause

While the sponsor question settles, the technical question opens. The 200ms real-time screening requirement needs an engineering answer before it can have a cost line, and the answer splits the room within an hour of the working session starting on 26 September.

Amara Okonkwo, Head of Compliance, argues the capability already half-exists. The fraud-monitoring service screens transactions today; extend its rule engine, tighten its latency, done. Dmitri Volkov, the platform integrator's lead, lets her finish and then reads from the contract.

Dmitri Volkov: “Clause 3.4 bounds our scope to the five fraud-touching services named at signature. None of them block in-flight. They score and flag asynchronously, Kafka consumer, sub-second on a good day, not 200 milliseconds guaranteed on any day. What you are describing is a new synchronous service in the payment path. That is either your build or our contract amendment. It is not a configuration change, and I will not let it be priced as one.”
Amara Okonkwo: “Then the contract is the constraint, not the architecture.”
Volkov: “Both true. Both billable.”

This is the same Volkov who refused to sign for dates in Post 05 and asked for a softer risk rating in Post 10. He is being neither difficult nor helpful here; he is being contractual, and on this occasion the contract discipline is doing the program a favor: it forces the build-versus-buy decision into the open before it becomes a change order dispute in January. Bank legal counsel confirms the clause reading the same day. Lena Marquez's contribution lands where Post 07 actually put her role: the regulator-facing response letter routes through her pre-approved communications path, while the amendment itself would move under the vendor's standing change-order framework, which is why the buy option is faster despite being a commercial negotiation.

The Two Options, Priced

DimensionOption A: Build In-HouseOption B: Contract Amendment (Vendor)
Cost $580K Internal squad plus infrastructure; no margin stack. $720K Vendor rate card plus amendment overhead; $140K premium over build.
Schedule +6 weeks New service in the payment path; squad formation and SLA hardening from zero. +3 weeks Vendor has a screening module in production at two other banks; integration, not invention.
Certification Risk Moderate Unproven component entering UAT late; latency evidence built from scratch for the March audit. Lower Module carries existing certification evidence from prior deployments; audit trail partially inherited.
Long-Term Ownership Clean Bank owns the component and the roadmap; no per-transaction licensing. Dependent Deepens vendor lock on a regulated control point; exit cost compounds.
Decision Authority Exceeds PM single-item authority ($100K). Steering decision either way. Exceeds PM single-item authority ($100K). Steering decision either way.
Build-versus-buy evaluation as it enters CR-001. Cell color encodes the directional verdict per dimension, not a preference for either option.

Neither option wins on the matrix, which is the honest result. Cost and ownership favor build; schedule and certification risk favor buy, and certification risk carries unusual weight in a year when the component's first auditor is the regulator who requested it. The matrix goes into CR-001 unresolved by design. The $140K gap and the regulated-control-point question sit above both the PM's $100K single-item authority and the sponsor's appetite to decide alone. This one belongs to steering, and the Change Request's job is to make steering's decision a fifteen-minute decision.

Drafting CR-001 with PEEL

A Change Request is not a form. It is a sequence of arguments, each of which must survive an audit it cannot see coming. Impact, cost, schedule, risk, recommendation: every section makes a claim, and in a regulated program every claim eventually meets someone, an auditor, a steering member, a successor PM, who asks where it came from. The drafting framework has to enforce traceability at the paragraph level, not just at the document level.

Framework: PEEL (Point, Evidence, Explanation, Link)

PEEL structures each unit of argument four ways: state the Point, present the Evidence, give the Explanation of why the evidence supports the point, then Link back to an authoritative source or forward to a consequence. It is a well-established framework in academic writing instruction; its use in prompt engineering for business artifacts is informal and lightly documented, so treat the prompt pattern below as a practitioner adaptation rather than a cited method. It earns its place here because the Link step is exactly the discipline a Change Request needs: every section must terminate in a citation, to the charter, the risk register, the contract, or the directive itself. A CR whose arguments all link to named sources defends itself in March. One built on unanchored assertion defends nobody.

Prompt · Change Request Draft · 26 September 2025
You are drafting a formal Change Request for a regulated banking program. Use the PEEL structure (Point, Evidence, Explanation, Link) inside every section: each section states its point, cites its evidence, explains the connection, and ends with an explicit Link line referencing a named source document. CONTEXT. Program Falcon, Atlas Bank. Budget USD 14.2M over 18 months, 3 markets, go-live 14 July 2026 (Market A). Currently Day 254, Phase 2 (Build and Integration). Charter signed 2 Feb 2025 with 7 tolerances; Tolerance T4 permits absorption of post-charter regulatory change up to USD 500K cumulative per market from the allocated regulatory-change contingency bucket; beyond that, a steering-approved Change Request is required. TRIGGER. Market C Central Bank, AML/CFT Directive 2025-04 Amendment 2, gazetted 18 Sep 2025, effective 1 Feb 2026. Two provisions: (1) enhanced transaction monitoring rules on cross-border remittances, mandatory at effective date, priced at USD 340K; (2) real-time screening at 200ms SLA, subject to a supervisory expectations period through Q2 2026 (regulator expects a credible plan, not a finished system). Two delivery options for provision 2: Build USD 580K / +6 weeks, or vendor contract amendment USD 720K / +3 weeks (contract clause 3.4 excludes this scope from current vendor terms). TASK. Draft Change Request CR-001 with sections: Summary; Origin and Regulatory Citation; Impact Assessment; Cost; Schedule; Risk (reference existing risk R01, Market C certification, and propose any new risk); Funding Source; Recommendation; Decision Required. Recommend absorbing provision 1 under Tolerance T4 and escalating the provision 2 build-vs-buy decision to steering on 2 Oct 2025. Every section must close with a Link line in the form "Link: [source document, clause/section]". Do not exceed 900 words. Flag anything you believe needs human judgment before this document is issued.

The Draft, and the Flag That Mattered

A representative extract. The full draft covered all nine sections; the two below show the PEEL discipline at work, and the flag box at the end is where the AI earned its seat at this particular table.

AI Draft · CR-001 · Sections 3 and 4 (Extract)

3. IMPACT ASSESSMENT. Point: Amendment 2 affects Falcon asymmetrically; provision 1 modifies existing scope while provision 2 introduces new scope. Evidence: the monitoring rule changes map to 3 of the program's 19 microservices (rules engine, case management, reporting), all in active build; the 200ms screening requirement maps to no existing service, confirmed by the platform integrator against contract clause 3.4. Explanation: changes to in-build services are absorbable rework; a new synchronous service in the payment path is new scope under any recognized definition, and treating it as rework would misstate the baseline. Link: Contract ATL-PI-2024-11, clause 3.4; Falcon Service Catalog v3.2.

4. COST. Point: total exposure is USD 920K to 1,060K; only USD 340K is absorbable within tolerance. Evidence: provision 1 priced at USD 340K (three-service rework estimate, workstream cost model); provision 2 priced at USD 580K (build) or USD 720K (amend). Explanation: Tolerance T4 caps per-market regulatory absorption at USD 500K cumulative; Market C has zero prior drawdown, so provision 1 fits with USD 160K headroom remaining, while provision 2 exceeds remaining headroom under either option. Link: Program Charter (2 Feb 2025), Tolerance T4; Contingency Register, regulatory-change bucket.

AI flagged: “The draft Recommendation currently prefers Option A (Build) on total cost. Two items need human judgment before issue: (1) the USD 140K cost gap may not outweigh certification risk in an audit year, and cost-led framing could pre-empt a decision that belongs to steering; (2) I cannot verify whether the regulatory-change contingency bucket is permitted to fund pre-certification directive work, or whether risk R01's allocation is certification-only. The funding source section should not be issued until that distinction is confirmed against the contingency policy.”

Both flags survived contact with reality, which is rarer than it sounds. The first flag caught the draft doing the thing drafts do: quietly converting a comparison into a recommendation because one number was smaller. The second flag caught a funding distinction that Thomas Richter confirmed the next morning: R01's allocation is scoped to certification costs only, and routing directive work through it would have created exactly the kind of ledger smudge the March audit exists to find. The AI did not know the answer. It knew there was a question, and it refused to bury it. That is the correct division of labor.

CR-001, as Issued

Change RequestCR-001 · v1.0
AML/CFT Directive 2025-04 Amendment 2 (Market C)
Project Falcon · Atlas Bank · Raised by Fasil Alemeye Abate, Program Manager
Status Proposed Raised 25 Sep 2025 · Sponsor sign-off 29 Sep 2025 · Steering item 2 Oct 2025

1. Summary

Market C Central Bank Directive 2025-04 Amendment 2 (effective 1 Feb 2026) introduces two provisions. This CR proposes: (a) absorb the mandatory monitoring provisions ($340K) under Charter Tolerance T4; (b) escalate the 200ms real-time screening capability ($580K to $720K) to the Steering Committee for a build-versus-buy decision on 2 Oct 2025. The regulator has confirmed a supervisory expectations period for the screening provision through Q2 2026 and expects a credible delivery plan by the effective date, not a completed system. Link: Market C briefing minutes, 25 Sep 2025, item 4.

2. Origin and Regulatory Citation

InstrumentAML/CFT Directive 2025-04, Amendment 2, gazetted 18 Sep 2025
Issuing AuthorityMarket C Central Bank, Directorate of Banking Supervision (O. Adebayo)
Effective Date1 Feb 2026 (provision 1 mandatory; provision 2 supervisory expectations period to Q2 2026)
ChannelQuarterly regulatory briefing per PMO-CC-002 (est. Post 07); formally minuted

3. Impact Assessment

Provision 1 reworks three in-build services (rules engine, case management, regulatory reporting). Provision 2 requires a new synchronous screening service in the payment path; no existing Falcon service supports in-flight blocking at a 200ms SLA, and the capability is excluded from the platform integrator's scope. Link: Contract ATL-PI-2024-11 clause 3.4; Service Catalog v3.2.

4. Cost

Provision 1 (absorb)$340K · within Tolerance T4 ($500K/market cap; Market C prior drawdown: $0; headroom after: $160K)
Provision 2, Option ABuild in-house: $580K, +6 weeks · steering decision required
Provision 2, Option BVendor contract amendment: $720K, +3 weeks · steering decision required

Link: Charter (2 Feb 2025), Tolerance T4; workstream cost model (Post 09 instrumentation); vendor quotation VQ-2025-31.

5. Schedule

Provision 1 rework lands within current Phase 2 sprint capacity; no firm commitment date moves. Provision 2 enters Phase 3 with either +3 or +6 weeks of component-level schedule; under both options the Market A go-live (14 Jul 2026) holds, conditional on Market C certification sign-off, which now explicitly includes directive compliance demonstration at the March 2026 audit. Link: Program Roadmap v2.3 (Post 05 commitment levels); Phase 3 plan.

6. Risk

R01 (existing)Market C certification risk: exposure increases; audit scope now includes Amendment 2 compliance. Probability raised. Owner: A. Okonkwo.
R12 (new)Regulator-relationship risk: partial-absorption posture misread as resistance if communicated poorly. Mitigation: response letter leads with regulator's own “credible plan” framing; sponsor-level delivery. Owner: F. Idris.

Link: Risk Register v1.0 (23 Apr 2025) and subsequent revisions.

7. Funding Source

Provision 1: allocated regulatory-change contingency bucket per T4. Not funded from R01's allocation, which is scoped to certification costs only, and not from the unallocated reserve, which remains at $328K, unchanged by this CR. Provision 2: new capital allocation, steering authority. Link: Contingency Register; Contingency Policy s.2.3.

8. Recommendation

Approve provision 1 absorption under T4 (sponsor signature, as amount exceeds PM single-item authority of $100K). Refer provision 2 to steering 2 Oct 2025 with the build-versus-buy evaluation attached, presented without a preferred option: the $140K gap, the certification-risk asymmetry, and the vendor-dependency question on a regulated control point together exceed any single role's decision rights. Link: Charter, Tolerance T4 and PM authority schedule; build-vs-buy matrix (attached).

9. Decision

SponsorProvision 1 absorption APPROVED · F. Idris, 29 Sep 2025
SteeringProvision 2 build-vs-buy: scheduled 2 Oct 2025 · outcome recorded in CR-001 v1.1
Tolerance Trace
How Directive 2025-04 Amendment 2 routes through the charter's seven tolerances. The trace is the argument: T4 absorbs what it was written to absorb, and routes the remainder to the authority that owns it.
DIRECTIVE 2025-04 AMENDMENT 2 $920K–$1,060K total T1 · Scope (features) T2 · Schedule (phase) T3 · Cost (workstream) T4 · Regulatory change ≤ $500K / market T5 · Resourcing T6 · Quality thresholds T7 · Vendor substitution Charter, 2 Feb 2025: seven explicit tolerances

ABSORBED UNDER T4 Provision 1 · $340K headroom left: $160K

ESCALATED: STEERING Provision 2 · build/buy 2 Oct 2025

What the Human Changed

What the Human Changed (AI Draft to Issued CR-001)
  1. Reframed the Recommendation from urgency to tolerance trace. The AI's draft justified the split primarily on regulatory urgency. Fasil rebuilt the section around the T4 citation: urgency is a circumstance, the tolerance is the authority, and audits are interested in the second.
  2. Removed the AI's preference for Option A. The draft leaned Build on the $140K gap. Fasil flattened it to a neutral presentation: the gap, the certification asymmetry, and the regulated-control-point dependency together place the decision at steering, and a CR that pre-decides for its decision body has overstepped its function.
  3. Added risk R12 and gave it to the sponsor. The AI's risk section covered delivery risks only. The largest risk in this CR is relational: partial absorption misread as resistance. The mitigation is communication, and the owner is the person with the relationship: Idris, not Okonkwo.
  4. Made the certification dependency explicit in Schedule. The draft kept the go-live date clean. Fasil added the conditional: Market A's 14 July 2026 go-live holds subject to Market C certification, which now includes Amendment 2 compliance demonstration. Hiding a known conditionality in a CR is how roadmaps quietly start lying.
  5. Rewrote Funding Source after Richter's confirmation. The AI flagged that it could not verify R01's funding scope. Richter confirmed certification-only. The issued section states explicitly what the money does not come from: R01's allocation and the $328K unallocated reserve, both untouched, both verifiable.
The Future Payoff

CR-001 becomes the program's regulatory-change precedent. When the Q3 contingency review lands (Post 17), the $340K T4 drawdown is already ledgered with a clause-level trace. When the March 2026 certification audit examines how Falcon handled Amendment 2 (Post 16), the answer is a minuted briefing, a signed CR, and a steering decision, end to end. And when steering is asked whether this program should continue at all (Post 18), CR-001 is exhibit one that Falcon under pressure produces governance, not improvisation.

The steering committee took eleven minutes on 2 October. The build-versus-buy outcome, and what it cost to make it stick, is Post 14's story, because the decision arrived welded to an architecture question the program had been deferring since Phase 1. CR-001 v1.1, recording the outcome, is filed the same afternoon.

The Takeaway
A Change Request is not resistance. It is the price of a number that still means something.
When a regulator moves the goalposts mid-build, the reflex is binary: absorb everything to protect the relationship, or contest everything to protect the baseline. Both reflexes destroy something. Absorbing silently destroys the budget's meaning; contesting destroys the relationship the program needs in certification season. The Change Request is the third path: split the directive along the seam the regulator gave you, absorb what the charter's tolerances were written to absorb, cite the clause, and route the remainder to the authority that owns decisions of that size. The charter language nobody has read since February turns out to be the only thing in the room that protects everyone, including the sponsor, from their own best instincts.

A fictional case study for teaching purposes. Atlas Bank, Project Falcon and all named individuals are invented. Technologies are industry-standard and publicly available.