Skip to main content
Use this guide to establish how your institution will validate, approve, and oversee AMLOK workflows. Agree the required explanations, records, and review controls for your deployment.

​
Define intended use

Document the lending product, population, sources, outputs, and permitted actions. Distinguish extraction and analysis from recommendations, policy evaluation, and decisions affecting an applicant or account. For Insights, define the assessment scope and evidence-review criteria. For Signal, define which changes produce an observation or risk alert. A monitoring signal alone should not be treated as a verified adverse finding. Your institution decides when and how to intervene.

​
Evidence and limitations

Establish the traceability required for your workflow, including source references, timestamps, transformations, policy and model versions, and the basis for material outputs. Identify missing or stale information, uncertain matches, and conflicting evidence. Explanations must reflect the actual analysis. Generated prose does not substitute for evidence or a reliable record of decision factors. Customers must approve the meaning and use of outputs before relying on them.

​
Validation and monitoring

OSFI’s revised E-23 addresses institutional model governance, including externally developed models, and takes effect on May 1, 2027. The institution remains accountable for model use. See E-23 for scope and transition planning.

​
Human review and consequential actions

Define who in your institution reviews, challenges and validates assessment outputs and what evidence it retains. AMLOK provides evidence and risk signals. Your institution performs all borrower outreach, collections, credit-limit changes and other interventions in its own systems. AMLOK has no servicing cases, tasks, borrower messages or action-approval workflow. Review Quebec automated-decision requirements and US credit-decision requirements. Human involvement does not eliminate privacy, fairness, or recordkeeping responsibilities.

​
Training and provider terms

Document whether each system uses customer information for inference, training, evaluation, or another purpose. Establish restrictions for AMLOK and external providers covering logs, retention, location, and secondary use. See privacy and data handling.