Absorbing Everything Is Not How You Keep a Regulator. Or a Budget.
What happens when the next request lands after a rejected proposal, and why absorbing it quietly costs more than raising the change would have.
The Quarterly Briefing Was Routine. Until Item Four.
Month 8 of 18. Phase 2, Build and Integration, is past its midpoint and holding. Eleven of nineteen microservices are feature-complete in at least one market. The velocity wobble from Post 11 has settled since the RACI decomposition. ADR-001 is closed and filed. The contingency reserve stands where it stood in July: $328K unallocated, with the allocated buckets drawn per the register. The next steering committee is Thursday, 2 October, first Thursday of the month as always, chaired by Fatima Idris.
And it is quarterly briefing week. Post 07 established PMO-CC-002: a formal, minuted, quarterly regulatory briefing per market, created after an informal coffee between a vendor lead and a regulator nearly became a governance incident. The mechanism was designed to give regulators a structured channel so that nothing about Falcon reached them through side doors. Mechanisms like this are insurance. Most quarters, the premium feels expensive and nothing happens.
The Market C briefing convenes at 10:00 local time in the central bank's offices. Across the table: Olumide Adebayo, Director of Banking Supervision, Market C Central Bank. He has chaired all three of Falcon's quarterly briefings in his market. He is precise, courteous, and reads every pre-read in full, which Fasil Alemeye Abate learned in Q1 when Adebayo quoted paragraph numbers back at him.
Items one through three are progress, risk posture, and the certification runway for the March 2026 audit. Item four is new. Adebayo slides a document across the table.
The date is the problem inside the problem. 1 February 2026 lands in the middle of Phase 3, UAT and Certification, which runs January through March. Whatever Falcon does about this directive, it does it while preparing for the certification audit the directive's own issuer will conduct. The two threads are now the same thread.
Fasil thanks Adebayo, confirms the program will respond through the formal channel within ten business days, and asks one question: whether the central bank distinguishes between the monitoring rule changes and the 200ms real-time screening requirement, or treats the amendment as indivisible. Adebayo's answer matters more than anything else said in the room.
That distinction is the seam the entire Change Request will be built along. The regulator did not ask for everything by February. The room, as Fasil is about to discover, heard everything.
The Sponsor Wants to Absorb All of It
Fasil briefs Fatima Idris the same afternoon, before the summary email can reach her through anyone else. Her reaction is immediate and strategic, which is what makes it dangerous.
Idris is not wrong about the relationship. She is wrong about what protects it. Her instinct is the instinct of a sponsor who has watched banks lose certification fights over posture rather than substance. But “absorb everything quietly” has a cost structure she has not seen yet, and it converts the program's $14.2M baseline into a number that no longer describes anything. The next variance report would be explaining overruns against a budget that was silently re-scoped without a paper trail. In a regulated program, that is not flexibility. That is the audit finding.
Fasil's counter rests on the charter signed 2 February 2025, Day 19, with its three firm commitments and seven explicit tolerances. Tolerance T4 was written for precisely this morning:
Post-charter regulatory change in any market is absorbed within the approved envelope up to USD 500K cumulative per market, funded from the allocated regulatory-change contingency bucket. Absorption beyond that threshold, or any change affecting a firm commitment date, requires a steering-approved Change Request.
The directive, fully absorbed, prices at $920K to $1.06M for Market C. T4 caps silent absorption at $500K. The math is not a negotiating position; it is a signature Idris herself put on the charter. Fasil's proposal: absorb the mandatory monitoring provisions ($340K, within T4, fully traceable) and take the 200ms screening build to steering on 2 October as a formal Change Request, exactly the credible plan Adebayo said his office expects.
Idris does not concede in the meeting. She concedes two days later, on 27 September, after reading the draft CR with the tolerance trace and the cost table. What moved her was not the argument; it was seeing T4 cited by clause number with the drawdown ledger attached. The charter language she signed in February turned out to be the thing protecting her from her own instinct in September.
200 Milliseconds, Two Paths, One Contract Clause
While the sponsor question settles, the technical question opens. The 200ms real-time screening requirement needs an engineering answer before it can have a cost line, and the answer splits the room within an hour of the working session starting on 26 September.
Amara Okonkwo, Head of Compliance, argues the capability already half-exists. The fraud-monitoring service screens transactions today; extend its rule engine, tighten its latency, done. Dmitri Volkov, the platform integrator's lead, lets her finish and then reads from the contract.
This is the same Volkov who refused to sign for dates in Post 05 and asked for a softer risk rating in Post 10. He is being neither difficult nor helpful here; he is being contractual, and on this occasion the contract discipline is doing the program a favor: it forces the build-versus-buy decision into the open before it becomes a change order dispute in January. Bank legal counsel confirms the clause reading the same day. Lena Marquez's contribution lands where Post 07 actually put her role: the regulator-facing response letter routes through her pre-approved communications path, while the amendment itself would move under the vendor's standing change-order framework, which is why the buy option is faster despite being a commercial negotiation.
The Two Options, Priced
| Dimension | Option A: Build In-House | Option B: Contract Amendment (Vendor) |
|---|---|---|
| Cost | $580K Internal squad plus infrastructure; no margin stack. | $720K Vendor rate card plus amendment overhead; $140K premium over build. |
| Schedule | +6 weeks New service in the payment path; squad formation and SLA hardening from zero. | +3 weeks Vendor has a screening module in production at two other banks; integration, not invention. |
| Certification Risk | Moderate Unproven component entering UAT late; latency evidence built from scratch for the March audit. | Lower Module carries existing certification evidence from prior deployments; audit trail partially inherited. |
| Long-Term Ownership | Clean Bank owns the component and the roadmap; no per-transaction licensing. | Dependent Deepens vendor lock on a regulated control point; exit cost compounds. |
| Decision Authority | Exceeds PM single-item authority ($100K). Steering decision either way. | Exceeds PM single-item authority ($100K). Steering decision either way. |
Neither option wins on the matrix, which is the honest result. Cost and ownership favor build; schedule and certification risk favor buy, and certification risk carries unusual weight in a year when the component's first auditor is the regulator who requested it. The matrix goes into CR-001 unresolved by design. The $140K gap and the regulated-control-point question sit above both the PM's $100K single-item authority and the sponsor's appetite to decide alone. This one belongs to steering, and the Change Request's job is to make steering's decision a fifteen-minute decision.
Drafting CR-001 with PEEL
A Change Request is not a form. It is a sequence of arguments, each of which must survive an audit it cannot see coming. Impact, cost, schedule, risk, recommendation: every section makes a claim, and in a regulated program every claim eventually meets someone, an auditor, a steering member, a successor PM, who asks where it came from. The drafting framework has to enforce traceability at the paragraph level, not just at the document level.
PEEL structures each unit of argument four ways: state the Point, present the Evidence, give the Explanation of why the evidence supports the point, then Link back to an authoritative source or forward to a consequence. It is a well-established framework in academic writing instruction; its use in prompt engineering for business artifacts is informal and lightly documented, so treat the prompt pattern below as a practitioner adaptation rather than a cited method. It earns its place here because the Link step is exactly the discipline a Change Request needs: every section must terminate in a citation, to the charter, the risk register, the contract, or the directive itself. A CR whose arguments all link to named sources defends itself in March. One built on unanchored assertion defends nobody.
The Draft, and the Flag That Mattered
A representative extract. The full draft covered all nine sections; the two below show the PEEL discipline at work, and the flag box at the end is where the AI earned its seat at this particular table.
3. IMPACT ASSESSMENT. Point: Amendment 2 affects Falcon asymmetrically; provision 1 modifies existing scope while provision 2 introduces new scope. Evidence: the monitoring rule changes map to 3 of the program's 19 microservices (rules engine, case management, reporting), all in active build; the 200ms screening requirement maps to no existing service, confirmed by the platform integrator against contract clause 3.4. Explanation: changes to in-build services are absorbable rework; a new synchronous service in the payment path is new scope under any recognized definition, and treating it as rework would misstate the baseline. Link: Contract ATL-PI-2024-11, clause 3.4; Falcon Service Catalog v3.2.
4. COST. Point: total exposure is USD 920K to 1,060K; only USD 340K is absorbable within tolerance. Evidence: provision 1 priced at USD 340K (three-service rework estimate, workstream cost model); provision 2 priced at USD 580K (build) or USD 720K (amend). Explanation: Tolerance T4 caps per-market regulatory absorption at USD 500K cumulative; Market C has zero prior drawdown, so provision 1 fits with USD 160K headroom remaining, while provision 2 exceeds remaining headroom under either option. Link: Program Charter (2 Feb 2025), Tolerance T4; Contingency Register, regulatory-change bucket.
Both flags survived contact with reality, which is rarer than it sounds. The first flag caught the draft doing the thing drafts do: quietly converting a comparison into a recommendation because one number was smaller. The second flag caught a funding distinction that Thomas Richter confirmed the next morning: R01's allocation is scoped to certification costs only, and routing directive work through it would have created exactly the kind of ledger smudge the March audit exists to find. The AI did not know the answer. It knew there was a question, and it refused to bury it. That is the correct division of labor.
CR-001, as Issued
1. Summary
Market C Central Bank Directive 2025-04 Amendment 2 (effective 1 Feb 2026) introduces two provisions. This CR proposes: (a) absorb the mandatory monitoring provisions ($340K) under Charter Tolerance T4; (b) escalate the 200ms real-time screening capability ($580K to $720K) to the Steering Committee for a build-versus-buy decision on 2 Oct 2025. The regulator has confirmed a supervisory expectations period for the screening provision through Q2 2026 and expects a credible delivery plan by the effective date, not a completed system. Link: Market C briefing minutes, 25 Sep 2025, item 4.
2. Origin and Regulatory Citation
| Instrument | AML/CFT Directive 2025-04, Amendment 2, gazetted 18 Sep 2025 |
| Issuing Authority | Market C Central Bank, Directorate of Banking Supervision (O. Adebayo) |
| Effective Date | 1 Feb 2026 (provision 1 mandatory; provision 2 supervisory expectations period to Q2 2026) |
| Channel | Quarterly regulatory briefing per PMO-CC-002 (est. Post 07); formally minuted |
3. Impact Assessment
Provision 1 reworks three in-build services (rules engine, case management, regulatory reporting). Provision 2 requires a new synchronous screening service in the payment path; no existing Falcon service supports in-flight blocking at a 200ms SLA, and the capability is excluded from the platform integrator's scope. Link: Contract ATL-PI-2024-11 clause 3.4; Service Catalog v3.2.
4. Cost
| Provision 1 (absorb) | $340K · within Tolerance T4 ($500K/market cap; Market C prior drawdown: $0; headroom after: $160K) |
| Provision 2, Option A | Build in-house: $580K, +6 weeks · steering decision required |
| Provision 2, Option B | Vendor contract amendment: $720K, +3 weeks · steering decision required |
Link: Charter (2 Feb 2025), Tolerance T4; workstream cost model (Post 09 instrumentation); vendor quotation VQ-2025-31.
5. Schedule
Provision 1 rework lands within current Phase 2 sprint capacity; no firm commitment date moves. Provision 2 enters Phase 3 with either +3 or +6 weeks of component-level schedule; under both options the Market A go-live (14 Jul 2026) holds, conditional on Market C certification sign-off, which now explicitly includes directive compliance demonstration at the March 2026 audit. Link: Program Roadmap v2.3 (Post 05 commitment levels); Phase 3 plan.
6. Risk
| R01 (existing) | Market C certification risk: exposure increases; audit scope now includes Amendment 2 compliance. Probability raised. Owner: A. Okonkwo. |
| R12 (new) | Regulator-relationship risk: partial-absorption posture misread as resistance if communicated poorly. Mitigation: response letter leads with regulator's own “credible plan” framing; sponsor-level delivery. Owner: F. Idris. |
Link: Risk Register v1.0 (23 Apr 2025) and subsequent revisions.
7. Funding Source
Provision 1: allocated regulatory-change contingency bucket per T4. Not funded from R01's allocation, which is scoped to certification costs only, and not from the unallocated reserve, which remains at $328K, unchanged by this CR. Provision 2: new capital allocation, steering authority. Link: Contingency Register; Contingency Policy s.2.3.
8. Recommendation
Approve provision 1 absorption under T4 (sponsor signature, as amount exceeds PM single-item authority of $100K). Refer provision 2 to steering 2 Oct 2025 with the build-versus-buy evaluation attached, presented without a preferred option: the $140K gap, the certification-risk asymmetry, and the vendor-dependency question on a regulated control point together exceed any single role's decision rights. Link: Charter, Tolerance T4 and PM authority schedule; build-vs-buy matrix (attached).
9. Decision
| Sponsor | Provision 1 absorption APPROVED · F. Idris, 29 Sep 2025 |
| Steering | Provision 2 build-vs-buy: scheduled 2 Oct 2025 · outcome recorded in CR-001 v1.1 |
What the Human Changed
- Reframed the Recommendation from urgency to tolerance trace. The AI's draft justified the split primarily on regulatory urgency. Fasil rebuilt the section around the T4 citation: urgency is a circumstance, the tolerance is the authority, and audits are interested in the second.
- Removed the AI's preference for Option A. The draft leaned Build on the $140K gap. Fasil flattened it to a neutral presentation: the gap, the certification asymmetry, and the regulated-control-point dependency together place the decision at steering, and a CR that pre-decides for its decision body has overstepped its function.
- Added risk R12 and gave it to the sponsor. The AI's risk section covered delivery risks only. The largest risk in this CR is relational: partial absorption misread as resistance. The mitigation is communication, and the owner is the person with the relationship: Idris, not Okonkwo.
- Made the certification dependency explicit in Schedule. The draft kept the go-live date clean. Fasil added the conditional: Market A's 14 July 2026 go-live holds subject to Market C certification, which now includes Amendment 2 compliance demonstration. Hiding a known conditionality in a CR is how roadmaps quietly start lying.
- Rewrote Funding Source after Richter's confirmation. The AI flagged that it could not verify R01's funding scope. Richter confirmed certification-only. The issued section states explicitly what the money does not come from: R01's allocation and the $328K unallocated reserve, both untouched, both verifiable.
CR-001 becomes the program's regulatory-change precedent. When the Q3 contingency review lands (Post 17), the $340K T4 drawdown is already ledgered with a clause-level trace. When the March 2026 certification audit examines how Falcon handled Amendment 2 (Post 16), the answer is a minuted briefing, a signed CR, and a steering decision, end to end. And when steering is asked whether this program should continue at all (Post 18), CR-001 is exhibit one that Falcon under pressure produces governance, not improvisation.
The steering committee took eleven minutes on 2 October. The build-versus-buy outcome, and what it cost to make it stick, is Post 14's story, because the decision arrived welded to an architecture question the program had been deferring since Phase 1. CR-001 v1.1, recording the outcome, is filed the same afternoon.
A fictional case study for teaching purposes. Atlas Bank, Project Falcon and all named individuals are invented. Technologies are industry-standard and publicly available.