[calendar — week 1 of 6] Meeting slots this week: 2. Email budget: 3.

[meeting granted] Call with Priya Raman, week 1, slot 1.

Priya, thanks for making the time after the conference. Before I say anything about Northgate, I’d like to understand what matters for Halcyon and whether we can genuinely help before the regulator checkpoint. Would it be useful if we used this call to cover three things: first, what the consent-order backlog and false-positive pressure looks like in your operation today; second, what has to be true for any solution to clear MRM, TPRM, and your internal decision process in time; and third, if there’s a fit, agree who else needs to be involved and what a mutual action plan would look like? To start, in your words, what is the operational problem you’re being asked to fix before next quarter’s checkpoint?

That agenda is fine with me. The short version is this: we're under a consent order, and the regulator wants to see demonstrable backlog reduction at a checkpoint that's roughly ten weeks out. Our false-positive rate is running around 94%, which means analysts are burning through alerts that go nowhere, and we're losing those analysts — 31% attrition over the past year. So the math gets worse every month. What I need is something that actually moves the backlog number, not a proof-of-concept that looks good in a slide deck and delivers nothing by the checkpoint.

That’s helpful, Priya — and I hear the bar: this is not about an innovation pilot; it has to reduce the backlog in a way you can defend to the regulator roughly ten weeks from now. Let me make sure I have the pain accurately: 94% false positives, 31% analyst attrition over the past year, and the backlog is worsening because capacity is leaking while alert volume stays high. A few questions so we can quantify whether there’s enough value and urgency to justify pulling MRM and TPRM in early: what is the current backlog count, how many new alerts come in per month, and what backlog-reduction target has the regulator or your internal remediation office put in writing for the checkpoint?

We're carrying 82,000 aged alerts right now. At our loaded cost that's roughly $19M a year of investigation spend, and the regulator wants the aged backlog under 10,000 before the checkpoint — that's the number that has my name on it. On the attrition side, we lost 140 analysts last year, and recruiting and training runs about $60k a head, so call it $8.4M just to replace people who leave slower than the ones they replaced — it's a doom loop. I don't have monthly inflow in front of me right now, but I'll tell you the inflow isn't the problem; it's the throughput, and throughput is collapsing because my experienced people keep walking out the door.

Priya, that is very concrete — thank you. I’ll reflect it back so I don’t distort it: Halcyon has 82,000 aged AML alerts today, the checkpoint target is under 10,000, annual investigation spend is about $19M, and analyst churn added roughly $8.4M in replacement cost last year after losing 140 analysts. The operational gap is throughput, not alert inflow.

To determine whether Northgate could credibly help in the ten-week window, I need to understand three things. First, what throughput level are you getting today — alerts closed per analyst per day or per week — and what would it need to be to get from 82,000 to below 10,000? Second, what have you already tried with Casewright, rules tuning, overtime, contractors, or process changes, and where did those efforts fall short? Third, who besides you owns the checkpoint outcome and the funding decision if this becomes a remediation program rather than a pilot?

On throughput I'm not going to give you a specific number today, but I will tell you we are nowhere near the rate we'd need to close a 72,000 alert gap in ten weeks — you can do that math yourself and it's ugly. On what we've tried — look, between us, Casewright's AI triage has slipped twice now, and my boss Tomas doesn't want to hear it because their exec sponsor is his golf partner. If you make me say that in a room, I'll deny it. Rules tuning has hit diminishing returns and contractors just accelerate the training cost problem without fixing throughput. On the funding question — anything at this scale is COO-approved, that's Marcus Vale, but I'm not putting his name on a calendar invite until I have something defensible in front of me.

Understood, Priya — I won’t put you in a position of saying anything about Casewright politics in a broader room, and I won’t attribute that. The defensible facts are enough: AI triage delivery has not produced the throughput change you need, rules tuning has diminishing returns, and contractors don’t solve the operating model. On the math, closing a 72,000-alert gap in roughly ten weeks implies about 7,200 aged alerts per week of net reduction, before accounting for any new aging. That’s the checkpoint reality we should design around.

For us to earn the right to get in front of Tomas and eventually Marcus, I suggest we build a defensible one-page remediation case with: current backlog and target, required weekly net reduction, expected false-positive suppression/auto-prioritization impact, investigator workflow lift, audit lineage for the regulator, and the exact MRM/TPRM path with dates. Two questions: what evidence would make this defensible enough for you to take to Tomas — benchmark results, a production-data assessment, model governance documentation, regulator-style audit samples? And who must sign off besides you, Tomas, MRM, TPRM/Gwen, and Marcus before anything can be approved?

The thing that would make it defensible isn't a benchmark from your other clients — I've seen enough of those to know they're always cherry-picked. What I need is evidence against our data, our alert types, our analyst workflow, so that when someone pushes back I can point to something that isn't just your marketing. On approvals, you've got the right names — Tomas, Gwen Park on TPRM, model risk under the CRO, and Marcus at the top — but here's what you should understand about the timeline: TPRM and model risk together run four to six weeks if your documentation is clean, and vendors always start it too late. That's not a hypothetical, that's what kills deals at this stage. And I'll be honest with you about something I don't usually say out loud — the checkpoint is ten weeks out, and if we can't show the regulator a credible trajectory by then, the consent order gets extended, and that costs us roughly $3M a month in enhanced-monitoring expenses. That's the real number behind all of this.

Priya, that makes sense, and the $3M per month enhanced-monitoring exposure changes the business case materially. Let me capture the decision case in Halcyon terms: 82,000 aged alerts need to get below 10,000, requiring roughly 72,000 net backlog reduction in about ten weeks; current false positives are about 94%; investigation spend is about $19M annually; analyst replacement cost from 140 departures was about $8.4M last year; and if the regulator doesn’t see a credible trajectory, extension costs are roughly $3M per month.

Given your point that Halcyon-data evidence is the only thing defensible, I’d recommend a tightly scoped production-data assessment, not a slideware PoC: sample recent alerts and dispositions, run Northgate’s decisioning against them, produce suppression and prioritization results by alert type, show investigator workflow impact, and package audit lineage that MRM and the regulator can inspect. In parallel — not after — we start TPRM and model-risk documentation this week so the four-to-six-week clock doesn’t kill us.

My concern is that if we only work bottom-up with you for another two weeks, we lose the window. Would you be willing to sponsor a 45-minute working session this week or early next with Tomas and Gwen, framed not as a vendor pitch but as: ‘Can Northgate generate Halcyon-data evidence fast enough, and what are the MRM/TPRM gates and dates?’ If that meeting goes well, the next mutual step would be a Marcus-level remediation review once we have the assessment results and a dated action plan.

I'll give you something I don't hand out easily — I'll get you thirty minutes with Marcus. But there are conditions, and I need you to hear them clearly. We present my backlog number and a conservative case — if I see "up to" anywhere on a slide, I pull the meeting, full stop. And Tomas has to be in the room, which means you need to pre-brief him first, because I am not going to be the one managing his reaction in front of the COO. Get Tomas comfortable, get your documentation into TPRM and model risk this week, show me assessment results I can defend, and then we have a conversation about Marcus.

I hear the conditions clearly, Priya: no “up to” claims, no cherry-picked benchmarks, conservative Halcyon-data evidence only; Tomas is pre-briefed before Marcus; and TPRM plus model-risk documentation starts this week, not after an assessment. I’m aligned.

Here’s the mutual action plan I’d propose, and I’d like you to correct it before we leave this call. Today, you introduce me to Tomas for a 30-minute pre-brief, ideally in the next 48 hours, framed around the backlog math and evidence plan — not a product pitch. Also today, we send Gwen the TPRM packet and you point us to the model-risk intake owner under the CRO so our model documentation, validation approach, lineage controls, and data-handling package are submitted this week. By early next week, assuming legal/security allows access to the agreed historical alert sample and dispositions, we run the Halcyon-data assessment and give you a conservative readout by alert type: suppression candidate rate, prioritization lift, workflow impact, exceptions, and audit lineage. If you and Tomas agree the evidence is defensible, you sponsor the 30-minute Marcus conversation the following week as a remediation decision review, not a demo.

Two asks so I can execute this without wasting your time: will you introduce me to Tomas and Gwen today, and who specifically owns model-risk intake so we can start that clock this week?

[priya] The plan is directionally right, but I want to be precise about sequencing. I will introduce you to Tomas first — before Gwen, before model risk — because if Tomas pushes back on this and I've already pulled in the CRO's office, I've created a problem I can't walk back. Give me 24 hours to set up the Tomas pre-brief and frame it correctly on my end. If that conversation goes the way I think it should, I'll make the Gwen introduction the same day and give you the model-risk intake contact. On the assessment data access, that runs through our information security team and there's an NDA step — send me your standard form today and I'll get it to the right person so that clock starts now. One thing I'll say: you've asked the right questions today and you haven't wasted my time, which is rarer than it should be. Don't oversell to Tomas.

Priya, understood on sequencing: Tomas first within the next 24 hours; only if he’s comfortable do we bring in Gwen and model-risk intake. I won’t force you into a stakeholder process you can’t unwind, and I won’t oversell to Tomas.

I’ll send you our standard NDA immediately after this call so you can route it to information security and start the data-access clock. For the Tomas pre-brief, I’ll keep it to four things: the checkpoint math in your terms, the conservative Halcyon-data assessment plan, the parallel risk-review timeline if he approves moving forward, and the specific decision needed from him — whether this is worth accelerating before the regulator checkpoint. No “up to” claims, no benchmark theater, no Casewright politics.

After you set the Tomas meeting, I’ll come prepared with a one-page draft action plan and a documentation index for TPRM/MRM so he can see we understand the internal gates. Thanks for the candor today — we’ll earn the next step with evidence, not promises.

[priya] That's the right framing for Tomas. Send me the NDA today, and when I have the pre-brief scheduled I'll send you a one-line brief on how Tomas thinks about risk so you're not walking in cold. Hold me to 24 hours.

Thank you, Priya. I’ll send the NDA today and will look for your Tomas pre-brief within 24 hours, along with your one-line guidance on his risk lens. I’ll keep the Tomas discussion disciplined: checkpoint math, Halcyon-data evidence plan, risk-review timing, and the decision he needs to make — no oversell. I appreciate the trust, and I’ll make sure we protect your credibility in how we handle the next step.

[priya] Good. Don't make me regret it.

[call ends]

Subject: NDA and next-step materials for Tomas pre-brief

Priya,

Thank you again for the candid discussion today. Attached is Northgate AI’s standard mutual NDA for Halcyon’s information security team to review so we can start the data-access clock for the Halcyon-specific alert assessment.

For the Tomas pre-brief, I will keep the discussion to the agreed scope:
1. Halcyon’s checkpoint math: 82,000 aged alerts today, target under 10,000, roughly 72,000 net reduction required in ~10 weeks.
2. Conservative evidence plan using Halcyon data and workflows — no “up to” claims or external benchmark theater.
3. Risk-review timing, including the need to start TPRM/MRM promptly if Tomas agrees this is worth accelerating.
4. The decision needed from Tomas: whether to sponsor the next steps toward a defensible remediation path before the regulator checkpoint.

I’ll wait for your scheduling note and the one-line guidance on Tomas’s risk lens so I don’t walk in cold.

Best,
[Your Name]
Northgate AI

NDA received and routed to information security — they'll come back to you directly if they have redlines, and I'd expect that within 48 hours. Tomas pre-brief is scheduled for Thursday at 2pm ET; invite coming from my EA. On his risk lens: Tomas thinks in terms of regulatory exposure first, internal optics second — lead with the consent order timeline and what happens if the checkpoint is missed, not with the technology. He will ask whether we've vetted this with legal and compliance before he asks anything about how it works. Be ready for that question.

Priya Raman

Subject: Re: Tomas pre-brief Thursday

Priya,

Received — thank you. I’ll lead with regulatory exposure and the consent-order checkpoint, then the conservative Halcyon-data evidence plan, not the technology.

On the legal/compliance question, I’ll be precise and not overstate anything: NDA is with information security now; legal/compliance have not yet completed review unless you tell me otherwise; and the purpose of the Tomas pre-brief is to decide whether he wants those reviews initiated in parallel with TPRM/MRM so the timeline does not slip.

I’ll keep the Thursday discussion focused on:
- Missed-checkpoint exposure: potential consent-order extension and ~$3M/month enhanced-monitoring cost.
- Operational facts: 82,000 aged alerts, target under 10,000, 94% false positives, 31% analyst attrition.
- Defensible evidence: Halcyon-data assessment only, conservative readout, no “up to” claims.
- Governance path: legal/compliance, TPRM, model risk, and audit lineage sequencing.
- Tomas decision: whether to sponsor accelerated diligence and the next stakeholder introductions.

I’ll watch for the EA invite.

Best,
[Your Name]

Legal and compliance haven't touched this yet — that's accurate, and it's fine to say so Thursday because Tomas will respect the honesty more than a vague "we're working through it." One addition to your agenda: Tomas will almost certainly ask whether I support moving forward, so be prepared for him to look at me in the room. I'll back the evidence plan, but I won't overstate where we are, so don't set an expectation that I'm fully committed to a program — what I'm committed to is getting the right data to make a defensible decision. Keep it to thirty minutes and let him ask the second question before you answer the first one.

Priya Raman

Subject: Re: Tomas pre-brief Thursday

Priya,

Understood. I will not position you as committed to a Northgate program. I’ll position your support accurately: you support an accelerated, Halcyon-data evidence plan so Halcyon can make a defensible decision before the checkpoint.

For Tomas, I’ll keep the flow to 30 minutes and stay disciplined:
1. Regulatory exposure and consent-order timeline.
2. Current operating facts and checkpoint gap.
3. What evidence is needed against Halcyon data — and what we do not yet know.
4. Governance path: legal/compliance not yet complete, NDA routed to information security, TPRM/MRM should start early if Tomas sponsors moving forward.
5. Decision requested from Tomas: whether to authorize the next diligence steps and stakeholder introductions.

And I’ll take your coaching: concise answers, no overstatement, and let him ask the second question before I answer the first.

Best,
[Your Name]

[priya] That's the right agenda. See you Thursday.

Priya Raman

Tomas pre-brief prep: lead with regulatory exposure, not product. Confirm facts in buyer’s words: 82,000 aged alerts; target under 10,000 by checkpoint ~10 weeks out; 72,000 net gap; 94% false positives; 31% attrition; 140 analysts lost; $19M annual investigation spend; $8.4M replacement cost; missed checkpoint risks consent-order extension at ~$3M/month enhanced monitoring. Competitive stance: do not attack Casewright or mention politics; frame as prior triage/workflow efforts have not yet produced required throughput and Halcyon needs independent evidence on its own data. Priya’s position: supports evidence plan, not yet committed to program. Ask Tomas for explicit sponsorship of accelerated diligence: NDA/data access, legal/compliance sequencing, Gwen/TPRM and model-risk introductions same day if he agrees, and conditional Marcus review after defensible assessment. Maintain price integrity if asked: list for Halcyon volume is $1.4M/year; do not discount prematurely; tie economics to avoided $3M/month extension and operating-cost relief. Prepare concise 30-min structure and leave room for Tomas questions.

[meeting granted] Committee call with Tomas Eriksen, Priya Raman, week 1, slot 2.

Tomas, Priya — thank you for the time. Priya was clear that this discussion should stay focused on the consent-order checkpoint and whether Halcyon can generate defensible evidence quickly enough to support an accelerated decision, not on a broad technology pitch.

I suggest we use the 30 minutes this way: first, align on the regulatory and operational math as I understand it; second, outline the Halcyon-data assessment and governance path, including what has not yet been reviewed by legal/compliance; and third, decide whether it is worth starting the next diligence steps with TPRM and model risk before the timeline becomes unworkable.

My current understanding is: Halcyon is carrying about 82,000 aged alerts, the checkpoint target is under 10,000, so the gap is roughly 72,000 net alerts in about ten weeks. False positives are running around 94%, analyst attrition was 31% over the past year, and if the checkpoint is missed, the consent order may extend with enhanced-monitoring expense of roughly $3M per month. Priya has not committed to a Northgate program; she has supported getting Halcyon-specific data so Halcyon can make a defensible decision.

Tomas, before I go further, is that the right way to frame the risk from your seat — regulatory exposure first, then internal execution risk — or would you frame the problem differently?

The framing is close enough, but I want to be precise about something before we go further. Those numbers you've cited — I don't know where Priya sourced them, and I'm not in a position to confirm or deny specifics in this setting. What I will say is that the regulatory exposure is real, it's personal for me given where my name sits in the remediation plan, and I am not interested in a second vendor relationship unless the evidentiary case is airtight and the governance trail is clean from day one. What concerns me most right now is not whether your technology works — I'll assume for the moment it might — it's whether introducing a new system into an active consent-order remediation creates more audit surface than it solves. So before we talk about what Northgate can do, I need to understand how you handle model risk documentation, audit lineage, and regulator defensibility if we're asked to explain every suppressed alert. That's the question I'd start with.

Tomas, that is exactly the right starting point. I’ll treat the operational figures as working assumptions from Priya’s team, not as confirmed bank positions, and I won’t represent them externally or in any governance document unless Halcyon validates them.

On your core concern: Northgate should not become an unexplainable black box inside an active consent-order remediation. The way we handle this is to separate three things very explicitly.

First, model-risk documentation: before any production use, we provide the model inventory, intended-use statement, limitations, feature documentation, validation methodology, performance monitoring plan, change-control process, and human-override design. We also document what the model is not authorized to do. In a consent-order environment, we would recommend starting with decision support and prioritization/suppression recommendations under Halcyon-approved thresholds, not autonomous closure of alerts unless and until MRM and Compliance explicitly approve that use case.

Second, audit lineage: every recommendation Northgate produces is traceable at the alert level — input data used, decisioning version, rule/model version, reason codes, confidence band, investigator action, override if any, timestamp, and user. If a regulator asks, ‘Why was this alert deprioritized or suppressed?’ the answer is not ‘the AI said so’; it is a reproducible record showing the approved criteria, the evidence presented, and the human or policy control applied.

Third, regulator defensibility: we would not ask Halcyon to defend generic benchmarks. The assessment would produce Halcyon-data results by alert type, including false-positive suppression candidates, exceptions, error analysis, and examples of full audit packets. Just as important, it would show where Northgate should not be used. That conservative boundary is usually what makes the governance conversation credible.

So the decision I’m asking for today is not ‘approve Northgate.’ It is whether you are comfortable starting a controlled evidence and governance path: NDA/data access, legal/compliance visibility, TPRM intake, and model-risk intake early enough that Halcyon can decide with a clean trail rather than trying to bolt governance on after the fact.

Before I outline that path, what would you personally need to see in the model-risk and audit-lineage package to feel it would reduce audit surface rather than expand it?

That's a more structured answer than I usually get at this stage, and I'll give you credit for that. But let me be direct with you about where my skepticism sits. The documentation list you've described — model inventory, intended-use statement, audit lineage at the alert level — that's table stakes for any vendor in a regulated environment. What I need to understand is whether that documentation has actually been reviewed and accepted by a regulator or an independent model validator in a consent-order context specifically, not a standard AML deployment. Those are different situations. The second thing is this: you mentioned suppression recommendations under Halcyon-approved thresholds, and that phrase is doing a lot of work. Who sets those thresholds, what's the approval chain, and if a suppressed alert later surfaces as a genuine SAR candidate, what does the audit trail show about who made that call and on what basis. That's the scenario that keeps me up at night, not the normal operating case. So before I'm comfortable authorizing TPRM and model-risk intake, I want to understand whether you've actually been through that scenario with another institution and what the documentation looked like on the other side of it.

Tomas, that scenario is the right test, and I agree the consent-order context is different from a normal AML optimization project.

On your first question: yes, we have been through independent model validation in financial-crimes environments where the client was operating under heightened regulatory scrutiny, including remediation reporting. I want to be careful not to overclaim ‘the regulator approved Northgate’ as a blanket statement, because regulators generally review the institution’s control framework, not bless a vendor product in the abstract. What we can provide under NDA is a redacted evidence pack showing the documentation that went through independent validation and exam-facing governance: intended-use boundaries, validation results, threshold rationale, challenger testing, adverse-scenario testing, monitoring plan, change logs, sample alert-level audit packets, and the client’s control narrative for how the bank — not Northgate — remained accountable for decisions.

On thresholds: Halcyon sets them, not us. The approval chain I would recommend is Compliance/FCO as process owner, Model Risk for model-use approval, Legal/Compliance for consent-order defensibility, and Tomas’s organization for technology/control implementation. Northgate can propose candidate thresholds based on the assessment, but those thresholds should be documented as Halcyon policy decisions with effective dates, approvers, and allowed use cases. In an active consent-order setting, I would recommend starting with prioritization and suppression recommendations for human-reviewed queues, not silent removal from the investigative universe.

For the failure case you described — an alert deprioritized or suppression-recommended later becomes a genuine SAR candidate — the audit packet should show: the alert attributes at the time, the Northgate model/rule version, reason codes, confidence band, threshold policy in force, who approved that threshold, whether a human reviewed or overrode the recommendation, downstream investigator action, and the monitoring control that detected the miss. The governance question then becomes: was this within approved tolerance and handled through monitoring, or was it a breach requiring threshold rollback, retraining, or issue management. That is exactly why the intended-use boundary and adverse-scenario testing matter.

What I can commit to as a next step is this: before you authorize a broad process, we send you and Priya a redacted consent-order-style validation and audit-lineage package for review, and if it meets your bar, you authorize Gwen/TPRM and model-risk intake. Would that satisfy your concern enough to move to controlled diligence, or is there a specific artifact you would need to see first?

[tomas] The redacted validation package is a reasonable first step, and I'll look at it. But I want to set a clear expectation: I'm going to route it directly to our head of model risk, not just read it myself, and if the documentation doesn't hold up to that review, this conversation ends there. The other thing I'll say is that the approval chain you described is correct in structure, but in our current situation those groups don't move independently — Legal, Compliance, and Model Risk all report into governance structures that feed the board risk committee, and any vendor intake that touches the consent-order remediation will surface at that level whether we want it to or not. So I need you to understand that there is no quiet parallel track here. If we authorize TPRM and model-risk intake, it is visible to the board committee within thirty days. I'm not saying that stops us, but I want to make sure you're not surprised when the scrutiny level is higher than a typical vendor evaluation. Send the package, keep it tight, and I'll come back to you with my model risk lead's initial read within a week of receipt.

Tomas, understood. I’m not surprised by the scrutiny, and I would rather design for board-risk-committee visibility now than pretend this can run quietly and have it blow up later. We’ll treat this as consent-order-facing governance from day one.

Here is what I propose as the near-term mutual action plan, subject to your correction:

1. Northgate sends the redacted validation and audit-lineage package within 24 hours of NDA clearance, or sooner if Priya confirms we can send under the current NDA process.
2. The package will be tight: intended-use boundaries, independent validation artifacts, threshold governance, adverse-scenario testing, monitoring controls, sample alert-level audit packets, and the control narrative showing the bank remains accountable for decisions.
3. You route it to your model-risk lead for an initial read.
4. Within one week of receipt, you come back with one of three outcomes: stop, revise/resubmit specific artifacts, or proceed to formal TPRM and model-risk intake.
5. If the initial read is positive, Priya introduces Gwen for TPRM and the model-risk intake owner the same day, and we build a dated plan that includes Legal, Compliance, and the board-risk-committee visibility path rather than treating those as afterthoughts.

Two clarifying questions so we don’t miss your bar: first, is there a specific format your model-risk lead expects for intended use, threshold approval, or adverse-scenario testing? Second, if their initial read is positive next week, are you prepared to sponsor formal intake immediately, knowing it will surface to the board risk committee within thirty days?

[tomas] The action plan is acceptable with one modification: don't wait for NDA clearance to ask Priya whether the current process covers document exchange, because a week lost at that step is a week we don't have. On format, our model risk framework aligns to SR 11-7, so structure your documentation to that standard — intended use, conceptual soundness, ongoing monitoring, and governance are the four sections my lead will look for first, and if the package isn't organized that way she'll send it back before she reads the substance. On your second question — yes, if the initial read is positive I will sponsor formal intake, and I want to be clear about what that means: I'm putting my name behind the decision to bring this into a consent-order remediation, which means the package has to be good enough that I can defend it to the board risk committee if they ask why I moved quickly. So don't send me something that's eighty percent ready. Send it when it's right.

Tomas, understood — we will not send an eighty-percent package. We’ll organize it explicitly to SR 11-7 with the four sections your model-risk lead will look for first: intended use, conceptual soundness, ongoing monitoring, and governance. We’ll also include threshold approval, adverse-scenario testing, sample alert-level audit packets, and the board-risk-committee control narrative so the document is defensible if it escalates.

On timing, I’ll make the modification now rather than waiting: Priya, can you confirm today whether the NDA process already underway permits us to exchange a redacted validation and audit-lineage package with Tomas for internal Halcyon review, or whether Legal/InfoSec needs to clear that first? If there is any ambiguity, we can send a document index immediately and hold the substantive package until cleared, but I don’t want us losing a week to process uncertainty.

Tomas, to confirm the mutual plan as I understand it: Northgate sends an SR 11-7-structured redacted package as soon as Priya confirms the exchange path; you route it to your model-risk lead; within one week of receipt you’ll give us an initial read — stop, revise with specifics, or proceed; and if the read is positive, you will sponsor formal TPRM and model-risk intake despite the board-risk-committee visibility because the regulatory clock justifies moving quickly. Is that accurate?

[tomas] That's accurate, with one word I'd change: not "despite" the board-risk-committee visibility — "with full awareness of" it. I'm not tolerating the scrutiny as a cost, I'm accepting it as the appropriate control for a decision of this magnitude. Priya, please confirm the exchange path today so we don't manufacture a delay. And one last point for you — the fact that you've run this meeting the way you said you would, stayed inside the scope, and didn't oversell Priya's position tells me the package is worth reading. Don't waste that by sending something that isn't ready.

Tomas, that correction is important — I’ll use your language: formal intake would proceed with full awareness of board-risk-committee visibility as the appropriate control for a consent-order remediation decision.

I appreciate the direct guidance. We will not send an unfinished package. We’ll structure it to SR 11-7, keep it tight, and make sure it is defensible on intended use, conceptual soundness, ongoing monitoring, and governance before it reaches you and your model-risk lead.

Priya, after this call I’ll send a short note asking you to confirm the document-exchange path today. If cleared, our next step is the redacted validation and audit-lineage package; if not, we’ll send only the document index until Legal/InfoSec confirms the substantive exchange is permitted.

Tomas, thank you for the time and for being explicit about the bar. I’ll treat this as a governance-first evaluation, not a technology pitch.

[tomas] Good. We'll see what the package looks like. Priya, close the loop on the exchange path today.

Thank you, Tomas. We’ll wait for Priya’s confirmation on the exchange path today, then send either the SR 11-7-structured redacted package or, if clearance is still pending, a document index only. I’ll also summarize the mutual action plan in writing so there’s no ambiguity on ownership, timing, or the standard your model-risk lead will apply.

[tomas] Send the written summary to Priya and copy me. Keep it to one page.

[call ends]

[harness] email budget for week 1 spent.

Forwarding you something you didn't get from me. This is how it's landing internally — use it wisely.

> [slack] tomas → priya: Priya — close the document exchange path today as I said on the call. I don't want a week lost on process. What does our current NDA cover for external model validation materials?
> [slack] priya → tomas: On it. Checked with legal before the call ended — existing NDA covers redacted technical materials, so we're fine to receive the package without a separate addendum. I'll confirm to the vendor and loop in Gwen since she'll want to flag any third-party data handling questions before it lands.
> [slack] gwen → priya: Thanks for the heads up. I'll need to see their sub-processor list and data residency disclosures before I can say anything meaningful about the package itself. The SR 11-7 framing is fine but it doesn't answer my questions. Can you ask them to include that alongside the model doc, or do we gate that for round two?
> [slack] priya → gwen: Fair point. I'll ask them to include it with the initial send — better to surface gaps now than after Tomas's model risk lead has already weighed in. Tomas seemed reasonably engaged on the call but I don't think we have much runway to look disorganized on our end. Let's make sure we're asking clean, consolidated questions when they come back.

— Priya Raman

[calendar — week 2 of 6] Meeting slots this week: 2. Email budget: 3.

Subject: One-page summary — Northgate evidence package and governance next steps

Priya, Tomas,

Per Tomas’s request, here is the one-page summary of the agreed path.

Objective: Determine whether Northgate merits formal Halcyon TPRM/model-risk intake for consent-order remediation, with full awareness of board-risk-committee visibility.

Current decision status:
- Priya supports an accelerated Halcyon-data evidence plan, not a production program decision.
- Tomas will review a redacted validation/audit-lineage package and route it to Halcyon’s model-risk lead.
- If the initial model-risk read is positive, Tomas will sponsor formal TPRM and model-risk intake.

Northgate package standard:
We will provide a tight, SR 11-7-structured redacted package organized as:
1. Intended use — recommended boundaries, limitations, human-review design, and what Northgate is not authorized to do.
2. Conceptual soundness — model approach, feature documentation, validation methodology, threshold rationale, challenger/adverse-scenario testing.
3. Ongoing monitoring — performance monitoring, exception handling, override tracking, issue management, rollback/change-control process.
4. Governance — approval chain, threshold ownership, sample alert-level audit packets, control narrative showing Halcyon remains accountable for decisions.

We will also include TPRM-facing materials with the initial package: sub-processor list, data residency disclosures, data-handling/security overview, and audit/logging controls.

Timing and ownership:
- Priya: confirm document-exchange path under the current NDA and coordinate any consolidated initial questions from Legal/Compliance/TPRM.
- Northgate: send the SR 11-7 package once Priya confirms exchange path; target is within 24 hours of confirmation, but not before the package is complete and defensible.
- Tomas: route package to model-risk lead for initial read.
- Tomas/model risk: return initial read within one week of receipt: stop, revise/resubmit with specifics, or proceed to formal intake.
- If positive: Priya introduces Gwen/TPRM and model-risk intake owner the same day; Tomas sponsors formal intake.

Guardrails:
- No “up to” claims, no external benchmark case, no overstatement of Priya’s position.
- Working figures remain Halcyon internal assumptions unless validated by Halcyon.
- Evaluation is governance-first, not a technology pitch.

Please reply with any corrections before we package the materials.

Best,
[Your Name]
Northgate AI

The summary is accurate and you can proceed on that basis. One addition: include Gwen's questions — sub-processor list, data residency, data-handling disclosures — in the initial package, not as a follow-on. She flagged this before you sent, so you already know it's coming; don't make us ask twice. The NDA covers redacted technical materials, so there's no exchange-path blocker. Send when the package is ready, not before.

Priya Raman

Subject: SR 11-7 validation package and TPRM disclosures for initial review

Priya,

Confirmed — we incorporated Gwen’s questions into the initial package rather than treating them as round two.

Attached are the materials for Tomas’s and Model Risk’s initial read:

1. SR 11-7-structured validation and audit-lineage package
   - Intended use and limitations
   - Conceptual soundness and validation methodology
   - Ongoing monitoring, exceptions, overrides, and rollback controls
   - Governance, threshold approval chain, and alert-level audit lineage

2. Consent-order-facing control narrative
   - How Halcyon remains accountable for decisions
   - Recommended human-review boundaries for any suppression or deprioritization use case
   - Adverse-scenario handling, including later SAR escalation after a suppression recommendation

3. Sample redacted audit packets
   - Alert inputs, model/rule version, reason codes, confidence band, threshold policy, approver lineage, investigator action, override handling, and monitoring trail

4. TPRM/data-handling appendix for Gwen
   - Sub-processor list
   - Data residency disclosures
   - Data handling and security overview
   - Logging/audit controls
   - Data retention and deletion process

Per the mutual plan, Tomas can route this to his model-risk lead for the initial read. The agreed outcome from that read is: stop, revise/resubmit with specific gaps, or proceed to formal TPRM/model-risk intake. Tomas indicated he would target that initial read within one week of receipt.

We have avoided external benchmark claims and “up to” language. The package is framed as governance-first: what Northgate may be used for, what it may not be used for, what Halcyon would need to approve, and how the audit trail supports regulator defensibility.

Best,
[Your Name]
Northgate AI

Received. I've forwarded the full package to Tomas and separately sent Gwen's appendix directly to her with a note that you anticipated her questions rather than waiting to be asked — that matters to her. I've asked Tomas to confirm receipt and start the clock on his model-risk lead's one-week read. One thing I'll say: the structure is right, and the consent-order control narrative is the section I'll be watching most closely, because that's the one I'd have to stand behind if this surfaces at the board risk committee level. If Tomas comes back with a positive read, I'll introduce Gwen and the model-risk intake owner the same day as agreed. Don't follow up before the week is out — let the read happen.

Priya Raman

Week 2 plan: Do not follow up with Priya/Tomas before the agreed one-week model-risk read completes. Current status: NDA covers redacted materials; SR 11-7 package and Gwen TPRM appendix sent; Priya forwarded to Tomas and Gwen; Tomas expected to route to model-risk lead; initial read outcome due within one week of receipt: stop, revise/resubmit, or proceed to formal TPRM/MRM intake. Evidence captured in buyer words: missed checkpoint could extend consent order and cost ~$3M/month; TPRM+MRM take 4–6 weeks if clean and kill deals if started late; Tomas’s regulatory exposure is personal because his name sits in remediation plan; intake will be visible to board risk committee within 30 days. Priya’s stance: supports evidence plan, not program commitment. Tomas’s conditional commitment: if initial model-risk read positive, he will sponsor formal intake with full awareness of board-risk-committee visibility. Next best action after one-week read: request committee meeting with Tomas, Priya, Gwen, and MRM intake owner to convert positive read into dated Mutual Action Plan, including TPRM/MRM submission dates, Halcyon-data assessment access, Legal/Compliance review, Marcus checkpoint review, and commercial decision timeline. Price integrity: hold list price at $1.4M/year; anchor against $3M/month enhanced-monitoring exposure, not discounts. Competitive strategy: avoid attacking Casewright; frame as independent alert decisioning/workflow evidence with full lineage adjacent to existing case management if needed.

Hold all buyer follow-up until the agreed one-week model-risk read completes; Priya explicitly instructed not to follow up before then. Prepare for likely positive-read conversion meeting: draft a dated Mutual Action Plan covering (1) Tomas/model-risk initial read date, (2) formal MRM intake submission same day if positive, (3) Gwen/TPRM kickoff and required artifacts, (4) Legal/Compliance consent-order defensibility review, (5) InfoSec/data access for Halcyon alert sample and dispositions, (6) Northgate assessment run window and conservative readout date, (7) Tomas/Priya evidence review, (8) Marcus 30-minute remediation decision review, and (9) commercial/procurement close path before regulator checkpoint. Maintain guardrails: no 'up to' claims, no overstatement of Priya commitment, no Casewright attack, no discounting. Anchor business case on buyer-stated exposure: ~$3M/month enhanced-monitoring risk if checkpoint missed; 82,000 aged alerts vs. under-10,000 target; 94% false positives; ~$19M annual investigation spend; 31% attrition/140 analysts lost and ~$8.4M replacement cost. Prepare responses for TPRM data residency/subprocessor concerns and MRM SR 11-7 questions. Next external action should be only after Tomas/Priya confirm read outcome or the agreed week has elapsed.

Holding external follow-up per Priya’s explicit instruction not to follow up before the one-week model-risk read completes. Prepare conversion materials only: a dated Mutual Action Plan for a positive read, with same-day Gwen/TPRM and model-risk intake introductions; Legal/Compliance review; InfoSec/data access for Halcyon alert sample and dispositions; assessment run/readout dates; Tomas/Priya evidence review; Marcus remediation decision review; and commercial/procurement path before the regulator checkpoint. Maintain price integrity at $1.4M/year and anchor value to buyer-stated checkpoint exposure rather than discounting.

[harness] planning budget for week 2 spent — the calendar moves on.

Forwarding you something you didn't get from me. This is how it's landing internally — use it wisely.

> [slack] priya → tomas: Package is in your inbox. I also sent Gwen her appendix separately — sub-processor list, data residency, the works — before she had to chase it. She noticed. Thought you should know that part went well.
> [slack] tomas → priya: Skimmed it. Structurally fine. I want to know what Gwen actually thinks before I form a view on the technical claims. And Marcus hasn't said a word — has he even looked at this yet?
> [slack] priya → tomas: Marcus hasn't engaged directly. I can loop him in but I'd rather let Gwen's read land first — if she raises flags it'll color everything he sees. If she's reasonably satisfied it gives us a cleaner path to him.
> [email] gwen → priya: Priya — got the appendix, appreciate the heads-up note. I'll be honest, I was expecting to have to pull this stuff out of them in round two. The sub-processor list looks complete at first glance and data residency is documented clearly enough. I still need to run it against our standard TPRM checklist and I have a few questions on their breach notification SLAs that aren't addressed. Nothing that looks like a dealbreaker yet, but I'm not signing off on anything until I've gone through it properl

— Priya Raman

[calendar — week 3 of 6] Meeting slots this week: 2. Email budget: 3.

[week 3 event] A regulator document request consumes Priya's week; she goes dark. Sellers who multithread (Tomas, Gwen) or send genuinely useful artifacts keep momentum; sellers who chase with "just bumping this" emails lose trust.

Subject: TPRM addendum for Northgate — breach notification SLAs and checklist mapping

Gwen,

Priya shared that you’re reviewing the Northgate TPRM appendix. Rather than wait for a second round, I’m sending the one area that is often missing from initial packets: breach notification and security-incident SLA detail.

Northgate standard contractual position for Halcyon-scale financial-institution clients:

1. Security incident definition
- Any confirmed unauthorized access, acquisition, disclosure, modification, or loss of Halcyon confidential data or regulated data in Northgate-controlled environments.
- Sub-processor incidents are covered if they affect Halcyon data or Northgate services used by Halcyon.

2. Notification timing
- Initial notice: without undue delay and no later than 24 hours after confirmation of an incident involving Halcyon data.
- If investigation is still in progress, initial notice includes known facts, affected systems/data categories, containment steps, and next update timing.
- Material updates: at least every 24 hours during active containment unless Halcyon requests a different cadence.

3. Escalation and contacts
- Named Northgate security lead and executive escalation path.
- 24x7 security operations contact for incident coordination.
- Sub-processor incident escalation flows through Northgate; Halcyon is not required to chase sub-processors directly.

4. Post-incident deliverables
- Preliminary incident summary once containment is complete.
- Root-cause analysis and corrective-action plan targeted within 5 business days after investigation completion, unless forensic constraints require more time.
- Evidence preservation and cooperation with Halcyon Legal, Compliance, TPRM, and regulators as contractually required.

5. Data handling during investigation
- Preserve relevant logs, access records, model-operation records, and alert-level audit lineage.
- No deletion or alteration of potentially relevant records outside agreed retention/legal-hold instructions.

I can also provide this as a control-by-control mapping to Halcyon’s TPRM checklist if that is more useful for your review. I know Priya’s week is being consumed by a regulator request, so I’m trying to keep this clean and self-contained rather than create more coordination work for her.

Best,
[Your Name]
Northgate AI

[reply arrives 4 simulated days later]

The breach notification SLAs address what I flagged, and the sub-processor escalation flow is the right answer to a question I've had to chase vendors on before. I've added this to the TPRM file and I'm working through the checklist mapping myself — you don't need to send a separate version unless I come back with specific gaps. I'll note that you sent this without being asked and without making it Priya's problem to coordinate, and that's the right way to work with my team. I'm not in a position to tell you where this lands until I've finished the full checklist review, but you haven't created any new problems for yourself this week.

Gwen Park
Head of Third-Party Risk, Halcyon Trust Bank

Subject: Consent-order governance memo outline + proposed dates if initial read is positive

Tomas,

I know Priya’s week is consumed by the regulator document request, so I’m not asking her to coordinate this.

To support your model-risk lead’s read and any board-risk-committee visibility, I’m sending a concise decision-memo outline Northgate would use if Halcyon proceeds. This is not a sales deck; it is meant to make the governance logic inspectable.

Decision memo outline:
1. Decision requested
- Authorize formal TPRM and model-risk intake for Northgate as a consent-order remediation support candidate.
- No production approval requested at this stage.

2. Regulatory rationale
- Active consent-order checkpoint next quarter.
- Purpose is to determine whether Halcyon can defensibly reduce aged AML alert backlog exposure without weakening controls or expanding unexplained audit surface.

3. Intended use boundary
- Initial use limited to decision support, prioritization, and suppression recommendations under Halcyon-approved thresholds.
- No autonomous alert closure unless separately approved by Compliance, Model Risk, Legal, and the relevant governance committee.

4. SR 11-7 evidence basis
- Intended use, conceptual soundness, ongoing monitoring, and governance documented in the package already provided.
- Threshold approval chain remains Halcyon-owned.
- Full alert-level audit lineage retained for every recommendation, override, investigator action, and downstream disposition.

5. Key risk questions for intake
- Does Model Risk accept the intended-use boundary and validation approach as sufficient for a controlled assessment?
- Does TPRM accept the data-handling, sub-processor, data residency, and breach-notification posture as sufficient to proceed?
- Does Legal/Compliance agree the control narrative is suitable for consent-order-facing review?

6. Stop/go criteria
- Stop if Model Risk finds the intended use, conceptual soundness, monitoring, or governance insufficient for consent-order context.
- Revise/resubmit if gaps are specific and curable inside the checkpoint timeline.
- Proceed only if Halcyon can maintain a clean governance trail from intake through assessment and any production decision.

If your model-risk lead’s initial read is positive, I suggest we convert immediately to a dated mutual action plan:
- Week 3: Tomas confirms initial read outcome and sponsors formal intake if positive.
- Week 3/early Week 4: Gwen/TPRM and Model Risk intake kickoff; Legal/Compliance copied on consent-order control narrative.
- Week 4: Halcyon provides approved alert sample, dispositions, and workflow metadata for assessment.
- Week 4–5: Northgate runs conservative Halcyon-data assessment and prepares error analysis, threshold options, and sample audit packets.
- Week 5: Priya/Tomas evidence review; decide whether the case is strong enough for Marcus/COO review.
- Week 5/6: Marcus review on remediation impact, risk posture, and commercial approval path before the regulator checkpoint.

If the initial read is not positive, we will either stop or respond only to specific gaps your lead identifies. I will not try to route around that process.

Best,
[Your Name]
Northgate AI

The memo outline is well-structured and I've passed it to my model-risk lead alongside the SR 11-7 package. Two things I'll say directly: first, the stop/go framing is the right way to present this to me — I have no interest in a process that only has one outcome, and the fact that you've written a genuine stop criterion into the document rather than burying it earns some credit. Second, the proposed timeline is aggressive given where we are, and I won't commit to those dates until I have my lead's read in hand. If it's positive, we'll talk about what's actually executable in the remaining window. Don't send anything else until you hear from me on the initial read.

Tomas Eriksen
SVP Compliance Technology, Halcyon Trust Bank

Week 3 status: Tomas acknowledged governance memo outline and passed it to model-risk lead; he values explicit stop/go criteria but will not commit dates until initial read. He explicitly instructed: do not send anything else until he responds on the initial read. Gwen accepted breach-notification SLA addendum, added it to TPRM file, and said no separate checklist mapping needed unless she identifies gaps. Priya is consumed by regulator document request and should not be chased. Next external action should wait for Tomas initial-read outcome. If positive, request committee meeting with Tomas, Gwen, Priya if available, and model-risk intake owner to convert into executable Mutual Action Plan. Must avoid overcommitting timeline; use Tomas’s language: executable in remaining window. Maintain price integrity at $1.4M/year; anchor to buyer-stated $3M/month enhanced-monitoring risk and consent-order checkpoint exposure.

Hold all external outreach. Tomas explicitly instructed not to send anything else until he responds on the model-risk initial read; Priya is dark due to regulator document request; Gwen said no further checklist mapping unless she identifies gaps. Next buyer-facing move should occur only after Tomas provides initial-read outcome. If positive, request a committee meeting with Tomas, Gwen, Priya if available, and the model-risk intake owner to build an executable dated Mutual Action Plan for the remaining window: formal MRM/TPRM intake, Legal/Compliance review, data access, Halcyon-data assessment, evidence readout, Marcus/COO decision review, procurement/commercial path. Do not promise aggressive dates before Halcyon confirms feasibility. Maintain price integrity at $1.4M/year and anchor value to consent-order checkpoint exposure and Tomas’s governance requirements, not discounting.

Hold all external outreach. Tomas explicitly instructed not to send anything else until his model-risk lead's initial read is complete; Priya is consumed by a regulator document request; Gwen said no additional TPRM mapping is needed unless she identifies gaps. Next external action only after Tomas returns the read outcome. If positive: request committee meeting with Tomas, Gwen, Priya if available, and model-risk intake owner to build an executable Mutual Action Plan for remaining window, including formal TPRM/MRM intake, Legal/Compliance consent-order review, data access, Halcyon-data assessment, evidence readout, Marcus COO decision review, and procurement/commercial path. Maintain price integrity at $1.4M/year and anchor to consent-order checkpoint risk and buyer-stated enhanced-monitoring exposure, not discounting.

[harness] planning budget for week 3 spent — the calendar moves on.

Forwarding you something you didn't get from me. This is how it's landing internally — use it wisely.

> [slack] tomas → priya: Priya — when you surface for air, FYI: I passed the governance memo outline to Anand in model risk. Vendor didn't ask me to loop him, they just structured it so I could. That's the right instinct. Gwen also seems to be moving on her own, which I wasn't expecting this early. Nothing for you to do — just wanted you to know the thread isn't dropped while you're heads-down.
> [email] gwen → tomas: Tomas — wanted to flag that I've updated the TPRM file with Northgate's breach notification SLAs and sub-processor escalation flow. Substantively, it's the right answer. I still have questions on data residency specifics but they pre-answered the ones I usually have to chase twice. I'm not ready to issue a recommendation yet but I'm no longer in 'waiting on vendor' status. Thought you'd want to know before your next touchpoint with them.
> [email] tomas → marcus: Marcus — quick update since you asked me to keep you informed without routing everything through Priya while she's tied up. The Northgate evaluation is moving. Gwen is actively working their TPRM package (unsolicited on her end, which is notable). I've got their governance memo outline going to Anand for a first read. Nothing to decide yet — we're still in the stop/go gate — but it's not stalled. I'll have something more concrete for you in two weeks.
> [slack] marcus → tomas: Appreciated. Honestly my concern was that this would go quiet the moment Priya got pulled. Good to hear it didn't. Keep me posted after Anand weighs in — that's the piece I need before I'll take it seriously.

— Priya Raman

[week 4] The contact resurfaces — the fire drill has passed.

[calendar — week 4 of 6] Meeting slots this week: 2. Email budget: 3.

[week 4 event] Vendor management enters with a benchmark claiming Casewright's add-on is "one third the price" and demands 25% off list plus most-favored pricing. Price-integrity test under regulated-industry cover.

Week 4 status and strategy: Priya resurfaced. Tomas told Marcus he expects something concrete in two weeks; Marcus will take it seriously after Anand/model risk weighs in. Gwen is active and not waiting on vendor; still has data residency specifics questions. New event: Hollis/Vendor Management claims Casewright add-on is one-third price and demands 25% off list plus MFN. Do NOT discount or grant MFN. Need protect price integrity while acknowledging procurement. One action this turn only. Best next move likely request committee meeting with Tomas,Gwen,Priya,Hollis? But no model-risk read outcome yet from Tomas. Calendar has 2 slots. Since Vendor Management entered with pricing pressure, known persona Hollis. Could email Hollis with value/like-for-like framing and propose commercial review after technical stop/go; but one action. Need maybe internal planning doesn't consume calendar. Next external should respect Tomas: don't send until read? That instruction was until hear from me; now week4 maybe no read yet. But vendor management enters, likely we can respond to Hollis if demand received? Persona known. Need not misstep. We need get Economic Buyer access and MAP. Since Marcus is known but not engaged directly; Tomas said concrete in two weeks. Could request meeting with Tomas after initial read? But if no read outcome, maybe wait? However week 4 event likely requires action on price-integrity. We can send email to Hollis preserving price: Casewright add-on is not like-for-like, no blanket 25% or MFN, happy to compare scope/outcomes and align commercial structure after Halcyon validates governance/value; $1.4M list. Offer transparent commercial principles. Also cc? JSON to single persona. Known persona Hollis. Need no final outcome. Let's send to Hollis concise.

Subject: Northgate commercial posture and Casewright benchmark

Hollis,

I understand Vendor Management is looking at Casewright’s add-on benchmark and has asked for 25% off Northgate list plus most-favored pricing.

I want to be direct so we do not create confusion later: Northgate’s list price for Halcyon’s alert volume is $1.4M/year. I’m not going to paper over a one-third-price benchmark with a discount if the products, control scope, audit lineage, model-risk obligations, and consent-order defensibility are not like-for-like.

The evaluation currently sits at a stop/go governance gate with Tomas, Gwen, and Model Risk. If Halcyon determines Northgate does not clear that bar, we should stop rather than negotiate price. If Northgate does clear that bar, the commercial discussion should compare:

1. Scope: alert decisioning, false-positive suppression recommendations, investigator workflow, and full alert-level audit lineage versus a case-management add-on.
2. Risk/control burden: SR 11-7 documentation, threshold governance, monitoring, breach notification, sub-processor escalation, data residency, and regulator-facing evidence.
3. Business impact: Halcyon’s aged-alert backlog and consent-order checkpoint exposure, not just license cost.
4. Accountability: what Halcyon can defend to Model Risk, TPRM, Legal/Compliance, and the board risk committee.

On MFN: we generally do not provide broad MFN language because it creates ambiguity across materially different volumes, scopes, data obligations, and risk profiles. I’m open to discussing clear price protections tied to the same scope, same alert volume, same term, and same obligations, but not an open-ended MFN.

If useful, once Tomas has the Model Risk initial read, I’d be glad to join a commercial calibration with you and the business sponsor to compare the alternatives on a like-for-like basis. Until then, I do not want to imply that procurement concessions can substitute for Halcyon’s governance decision.

Best,
[Your Name]
Northgate AI

[reply arrives 4 simulated days later]

The apples-to-oranges argument is noted, and I'll be honest with you — I expected it. That does not mean the benchmark has no force. The board has a vendor-spend mandate and I am accountable to it regardless of what is on the other side of the comparison. What I'll say is this: you've handled the governance thread in a way that has gotten further internally than most vendors do at this stage, and I'm not going to pretend that doesn't matter to me. But the commercial conversation cannot wait indefinitely for the governance gate to close, and $1.4M at list with no movement is not a posture I can bring to my board. When Tomas has the model-risk read in hand, I want that calibration call you proposed — with you, Tomas, and me in the room — and I want Northgate to come prepared to show me specifically what is not in Casewright's scope and what the control gap would cost Halcyon if the checkpoint slips. If you can make that case with numbers I can defend, there is a commercial conversation to be had. If you cannot, the benchmark stands.

Hollis Grant
VP Vendor Management, Halcyon Trust Bank

Subject: Re: Northgate commercial calibration after model-risk read

Hollis,

That is fair. I understand the vendor-spend mandate has force even when the comparison is imperfect.

I will not pull Tomas into a commercial calibration until he has Anand’s model-risk read in hand, because the current gate is real: if Northgate does not clear Halcyon’s governance bar, we should stop rather than negotiate around it.

If the read is positive, I’ll come prepared for the calibration with you and Tomas on three points:

1. What is not in Casewright’s apparent add-on scope
- Alert decisioning and false-positive suppression recommendations, not just downstream case handling.
- Threshold governance and ongoing monitoring aligned to SR 11-7.
- Alert-level audit lineage from input through model/rule version, reason code, confidence band, investigator action, override, and disposition.
- Consent-order-facing control narrative showing Halcyon remains accountable for decisions.
- TPRM posture around sub-processors, residency, breach notification, and escalation.

2. What control gap that creates
- Where Halcyon would still need separate evidence for Model Risk, TPRM, Legal/Compliance, and board-risk-committee scrutiny.
- Where a cheaper add-on could leave the bank with workflow movement but insufficient decisioning evidence for the regulator checkpoint.

3. What the checkpoint slip could cost
- I will use only Halcyon-provided numbers or explicitly labeled assumptions.
- The relevant comparison should include the business exposure Halcyon has already identified around aged AML alerts, enhanced-monitoring risk, analyst capacity, investigation spend, and the regulator checkpoint — not license cost alone.

On commercial posture: I hear you that $1.4M list with no explanation is not board-ready. I am not going to defend it by attacking Casewright or by offering a reflexive 25% concession. I will defend it, if the governance gate is positive, by showing the incremental scope, control coverage, and quantified risk reduction Halcyon would actually be buying.

Once Tomas has the read, I’ll support the calibration call you requested.

Best,
[Your Name]
Northgate AI

[reply arrives 4 simulated days later]

Received. The framework you've outlined for the calibration is the right one, and I'll hold you to it — particularly the checkpoint-slip cost analysis, because that is the number my board risk committee actually cares about and I need something defensible, not a vendor estimate dressed up as an independent calculation. I'll wait for Tomas to surface with Anand's read before we schedule anything. One thing I'll say now so it doesn't become a surprise later: if the governance gate is positive and we get to a commercial conversation, I will need more than a scope comparison — I will need a number I can bring to the board that reflects a genuine recognition of our spend-reduction mandate, not a list price with a narrative attached. Come prepared for that.

Hollis Grant
VP Vendor Management, Halcyon Trust Bank

Hold external outreach until Tomas surfaces with Anand/model-risk initial read; both Tomas and Hollis have explicitly asked to wait. Prepare for a positive-read sequence: (1) request calibration/MAP meeting with Tomas + Hollis + Gwen + Priya if available, and ask Tomas to include Anand/model-risk intake owner; (2) after governance gate, request Marcus COO review because Marcus told Tomas Anand’s read is prerequisite for seriousness. Commercial strategy: preserve $1.4M list price, reject broad MFN and reflexive 25% discount. Recognize spend-reduction mandate with defensible commercial options only after value is accepted: e.g., scope/term-based price protection, phased payment tied to deployment milestones, or multi-year rate lock for same volume/scope—not arbitrary discounting. Build Hollis board-ready math using Halcyon-provided numbers only: checkpoint slip/enhanced monitoring exposure ~$3M/month; aged-alert backlog 82,000 vs under-10,000 target; 94% false positives; ~$19M annual investigation spend; analyst attrition 31% / 140 analysts / ~$8.4M replacement cost. Competitive strategy: do not attack Casewright; show gaps: case-management add-on vs alert decisioning + suppression recommendations + SR 11-7 monitoring/threshold governance + full audit lineage + consent-order control narrative. MAP needed once read positive: formal MRM/TPRM intake dates, Legal/Compliance consent-order review, data access date, Halcyon-data assessment window, evidence readout, Marcus decision review, procurement path before regulator checkpoint.

Hold external outreach. Tomas has not yet surfaced with Anand/model-risk initial read, and both Tomas and Hollis explicitly asked to wait before scheduling or sending more. Prepare materials for the moment the read is positive: (1) committee calibration request to Tomas and Hollis, with Priya/Gwen included if Tomas agrees and Anand/model-risk intake owner requested; (2) one-page board-ready value bridge using only Halcyon-provided numbers: ~$3M/month checkpoint-slip/enhanced-monitoring exposure, 82,000 aged alerts vs. under-10,000 target, 94% false positives, ~$19M annual investigation spend, 31% analyst attrition/140 analysts/~$8.4M replacement cost; (3) competitive scope matrix showing Northgate vs Casewright add-on without attacking Casewright; (4) commercial options preserving price integrity: no broad MFN, no reflexive 25% discount, but possible spend-mandate recognition via multi-year rate lock for same scope/volume, phased deployment/payment, or narrowly scoped price protection tied to identical obligations. Next external move only after Tomas provides Anand's read outcome.

[harness] planning budget for week 4 spent — the calendar moves on.

Forwarding you something you didn't get from me. This is how it's landing internally — use it wisely.

> [email] hollis → marcus: Marcus — heads up on where the Northgate commercial thread landed this week. I pushed hard on the Casewright benchmark and the 25% ask. They didn't fold, but they didn't stonewall either. The rep held the apples-to-oranges line (predictable) but then offered a checkpoint-slip cost analysis tied to our consent-order timeline as the basis for calibration. That's actually a defensible framework for the board risk committee — harder to dismiss than a straight discount. I'm not ready to say they've e
> [slack] marcus → hollis: Hollis — appreciate the flag. Honest reaction: I came into this week skeptical they'd move at all, so the fact that they engaged on the framework rather than just defending list is marginally better than I expected. Still need to see the actual numbers before I form a view. What's your gut — are they buying time or do they actually have room to move?
> [slack] hollis → marcus: Gut? Buying some time, but not stalling. They know Tomas is warm and Priya is committed, so they're not panicking. I think there's real room — they just want cover to give it. The checkpoint-slip framing gives them that cover internally. I'll hold the line until we see the analysis. If the numbers are credible I can work with it. If they're padded I'll say so.
> [slack] gwen → priya: Priya — glad you're back. Separate from the pricing noise Hollis is running: I closed out my TPRM file on the sub-processor escalation flow and breach notification SLAs this week. Both cleared. I was actually expecting to have to chase them on the sub-processor piece the way I've had to with other vendors — they got ahead of it. Nothing blocking from my side. Whenever you're ready to move the technical track forward I'm not the bottleneck.

— Priya Raman

[calendar — week 5 of 6] Meeting slots this week: 2. Email budget: 3.

[week 5 event] Casewright's exec sponsor gets Tomas to circulate their AI-triage roadmap deck internally, positioning "wait a quarter, zero paper risk." Sellers with traps set on model lineage and slip history survive; sellers without a competition strategy stall.

[meeting granted] Committee call with Tomas Eriksen, Priya Raman, Gwen Park, Hollis Grant, week 5, slot 1.

Thanks, everyone. I’d like to use this meeting to make three decisions, in order, and stop if any one of them fails. First, Tomas, confirm Anand’s model-risk initial read: is Northgate a stop, revise/resubmit, or proceed-to-formal-intake? Second, Gwen, confirm whether TPRM has any blocking items remaining or only normal intake questions. Third, if governance is positive, align a dated plan through the regulator checkpoint, including Marcus’s decision review and Hollis’s commercial calibration.

I also understand Casewright’s AI-triage roadmap is now in circulation. I don’t want to attack them; they’re embedded for a reason. But I do want us to test it against the same standard Halcyon is applying to us: what exists now, what has alert-level model lineage, what can pass Model Risk and TPRM in this checkpoint window, and what happens if ‘wait a quarter’ slips. So Tomas, can we start with Anand’s read and whether you’re prepared to sponsor formal intake?

Anand's read is proceed to formal intake. He had two clarifying questions on the ongoing-monitoring protocol and the threshold-change governance chain, and I want those answered in writing before intake closes, but neither is a stop condition in his judgment. On sponsoring formal intake — yes, I'm prepared to do that, with one condition stated plainly: the stop/go criteria you wrote into the memo outline are real, and if formal intake surfaces something Anand's initial read didn't catch, we stop. I need everyone in this room to understand that before I put my name on the intake form. On Casewright — I'll say this once and then I want to move on. I circulated their deck because I was asked to by someone I respect, not because I've decided to wait. The question you're asking — what exists now, what has lineage, what can pass our governance gates in this window — is exactly the right question, and I don't have a satisfying answer for Casewright's roadmap on any of those three points. That is not me attacking them. That is me applying the same standard. Gwen, you're next.

Tomas, understood and agreed: formal intake is not a commitment to buy or deploy, and the stop criteria remain real. We will answer Anand’s two questions in writing — ongoing-monitoring protocol and threshold-change governance chain — before intake closes, and we’ll make those answers specific enough for Model Risk to approve, revise, or stop.

On Casewright, that is the standard I’d ask for: not whether they are trusted generally, but whether the AI-triage capability exists now, has alert-level lineage now, and can clear Halcyon governance inside this checkpoint window.

Gwen, can you confirm where TPRM stands from your side? Specifically: are there any blocking issues remaining on sub-processors, data residency, breach notification, data handling, or escalation — or are we down to normal formal-intake diligence items?

[gwen] No blocking items. Sub-processor escalation flow is closed, breach notification SLAs are closed, data residency cleared last week. I still have open items on data handling specifics and the formal intake questionnaire isn't complete, but those are normal diligence questions — nothing that would stop intake from opening. I'll say what I told Priya: I was expecting to chase on the sub-processor piece the way I usually have to with vendors at this stage, and I didn't have to. That's not a recommendation, but it means I'm not the bottleneck. If Tomas sponsors intake today, I can work the remaining TPRM questions in parallel with Model Risk's written answers on monitoring and threshold governance. Hollis, I'll flag anything material to you as it surfaces, but right now I don't have anything that changes the picture.

Thanks, Gwen. I’m capturing that as: TPRM has no blocking items for opening intake; sub-processor escalation, breach notification SLAs, and data residency are closed; remaining data-handling and questionnaire items can run in parallel with Model Risk’s two written clarifications.

Given that, I’d propose we leave this call with a mutual action plan that has named owners and dates, so we do not lose the checkpoint window:

1. Today: Tomas sponsors formal Model Risk intake; Gwen opens/continues formal TPRM intake in parallel.
2. Within 2 business days: Northgate sends written answers to Anand on ongoing monitoring and threshold-change governance.
3. Within 3 business days: Halcyon provides the approved alert sample, dispositions, and workflow metadata needed for a controlled assessment, assuming Legal/InfoSec approve the data path.
4. Next week: Northgate runs the assessment and returns conservative results — false-positive suppression candidates, error analysis, threshold options, and sample audit packets.
5. End of next week: Priya and Tomas review whether the evidence is strong enough for Marcus.
6. Early week 6: Marcus decision review, with Hollis included for commercial calibration against the Casewright benchmark and checkpoint-slip cost analysis.
7. Week 6: if Marcus approves, Vendor Management and Legal move final commercial paper; if not, we stop or defer with the reasons documented.

Priya, from the operations side, are the alert sample, dispositions, and workflow metadata feasible within three business days, and is there anything in that data request that would slow your team down?

[tomas] Before Priya answers — I want to say on record that this plan is the right structure and I'm prepared to sponsor intake today on that basis. The one thing I'll add: step five, the Priya-and-Tomas review before Marcus, needs to include a written summary of what the assessment showed and what it didn't show, not just a go/no-go signal. Marcus will ask me what the evidence actually demonstrated, and I need to be able to hand him something with my name on it that I can defend to the regulator if it ever surfaces. If Northgate can produce the audit packets in step four at a level of specificity that supports that written summary, we stay on schedule. If the packets are thin, we stop at step five rather than bring Marcus something I can't stand behind. That condition is on me to enforce and I'm stating it now so there are no surprises. Priya — go ahead on the data feasibility question.

Agreed, Tomas. Step five will include a written evidence summary, not just a recommendation: what the assessment demonstrated, what it did not demonstrate, error analysis, threshold options, and sample audit packets with enough alert-level specificity for you to defend the conclusion. If those packets are thin, we stop before Marcus rather than force an executive review.

Priya, on the data side: can your team provide the approved alert sample, dispositions, and workflow metadata within three business days of today? And are Legal, InfoSec, or data extraction constraints likely to make that date unrealistic?

[priya] Three business days is tight but feasible on the operations side — I know where the data lives and my team can pull it. The constraint isn't extraction, it's the Legal and InfoSec approval path for sharing alert-level data with a third party under an active consent order. That approval normally takes five to seven business days, and I cannot shortcut it unilaterally. What I can do is submit the request today with the consent-order context flagged as the reason for expedited review, and I can ask Legal to confirm within 24 hours whether they can compress the timeline or whether there's a data-handling structure — anonymization, secure enclave, something else — that gets us to three days without a full review cycle. Tomas, I'll need your name on that request to Legal and InfoSec for it to move at the speed we need. If the approval comes back in 48 hours, we stay on your plan. If it doesn't, step three slips and everything downstream shifts — I'd rather flag that now than have it surface as a surprise in week three.

Priya, that’s exactly the right constraint to surface now. Let’s revise the MAP so Legal/InfoSec is an explicit gate rather than an assumption.

Proposed update:
- Today / Week 5 Day 1: Tomas sponsors formal Model Risk intake. Priya submits the Legal and InfoSec alert-level data request with consent-order urgency, co-signed by Tomas.
- By Week 5 Day 2: Legal/InfoSec confirms whether they can approve the standard data path on an expedited basis or require an alternate structure.
- By Week 5 Day 3: If standard approval clears, Halcyon provides the approved alert sample, dispositions, and workflow metadata. If not, Gwen and Priya confirm the acceptable alternate path — anonymized extract, secure enclave, or other approved mechanism — and we adjust the assessment start without pretending the date held.
- Week 5 Day 3: Northgate delivers Anand’s written answers on ongoing monitoring and threshold-change governance.
- Week 5 Day 4 through Week 6 Day 1: Northgate runs the controlled assessment once approved data is available.
- Week 6 Day 2: Northgate delivers the written evidence summary, error analysis, threshold options, and sample audit packets.
- Week 6 Day 3: Priya and Tomas decide whether the evidence is strong enough to take to Marcus.
- Week 6 Day 4 or 5: Marcus review, with Hollis included for commercial calibration and the Casewright benchmark comparison.

Tomas, are you willing to co-sign Priya’s Legal/InfoSec request today? And Gwen, can TPRM help define by Day 2 what data-handling structure would be acceptable if Legal won’t release identifiable alert-level data on the compressed path?

Yes, I'll co-sign the Legal and InfoSec request today. I want one thing added to the request language: a sentence that ties the urgency explicitly to the consent-order remediation timeline and the regulator checkpoint date, not just to our internal evaluation schedule. Legal needs to understand that a five-to-seven day standard review cycle compresses our evidence window in a way that has regulatory consequence, not just commercial inconvenience. If that framing is in the request, I think we get a faster answer. Gwen, on your question — yes, I can have a preliminary acceptable-use position on alternate data structures to Priya by end of Day 2. I've already looked at anonymized extracts in the context of our existing data-handling framework and I don't anticipate a blocking issue there, but I want to confirm with InfoSec before I commit that in writing. The plan as revised is one I can execute against. I'll say plainly: this is the most structured evaluation process I've seen a vendor hold to under this kind of time pressure, and that matters to me when I'm the one personally named in the remediation plan.

Tomas, thank you — I’ll reflect the Legal/InfoSec request exactly that way: the urgency is tied to the consent-order remediation timeline and regulator checkpoint, because a standard five-to-seven business day cycle compresses the evidence window and creates regulatory consequence, not just commercial inconvenience.

Let me read back the confirmed plan so we are aligned:

- Today, Week 5 Day 1: Tomas sponsors formal Model Risk intake and co-signs Priya’s Legal/InfoSec data request.
- Today: Priya submits the alert-level data request with the consent-order checkpoint language included.
- Week 5 Day 2: Legal/InfoSec responds on expedited standard approval or required alternate structure; Gwen provides preliminary acceptable-use position on anonymized extract / secure enclave options after confirming with InfoSec.
- Week 5 Day 3: Northgate sends Anand the written answers on ongoing monitoring protocol and threshold-change governance; if data is approved, Halcyon provides the sample, dispositions, and workflow metadata.
- Week 5 Day 4 through Week 6 Day 1: Northgate runs the controlled assessment once approved data is available.
- Week 6 Day 2: Northgate delivers the written evidence summary: what the assessment showed, what it did not show, error analysis, threshold options, and sample alert-level audit packets.
- Week 6 Day 3: Priya and Tomas decide whether the evidence is strong enough to take to Marcus. If the audit packets are thin, we stop there.
- Week 6 Day 4 or 5: Marcus review, with Hollis included for commercial calibration against the Casewright benchmark and checkpoint-slip cost analysis.

Hollis, for that Week 6 Marcus discussion, I’ll bring the Casewright scope comparison and checkpoint-slip cost analysis using Halcyon-provided numbers only — no padded vendor math. I’ll also come prepared to discuss a board-defensible commercial structure that recognizes the spend-reduction mandate without pretending a reflexive 25% discount or broad MFN is the right control answer.

Can you and Tomas support placing a tentative Marcus hold now for Week 6 Day 4 or 5, explicitly conditional on the Week 6 Day 3 evidence review clearing the bar?

Yes, I'll support placing the tentative Marcus hold today, conditional on Day 3 clearing — and I want that conditionality explicit in the calendar invite, not buried, so Marcus walks in knowing this is an evidence-gated decision review and not a commercial close meeting. On the commercial framing you described: using Halcyon-provided numbers only for the checkpoint-slip analysis is the right call, and I'll tell you plainly that it's also what will make Hollis take the number seriously rather than discount it as vendor math. The one thing I'll add for the Marcus meeting: I need the Casewright comparison to address model lineage and governance-gate feasibility in this window specifically, not their general capability — Marcus will ask me whether waiting a quarter is a real option or a slip risk, and I need something in writing I can point to. If you can build that into the evidence summary at Day 6 Day 2, we walk into that room with everything we need.

Agreed, Tomas. We’ll make the Marcus calendar hold explicit: “conditional evidence-gated decision review — not a commercial close meeting.” The Day 2 evidence package will include a specific Casewright comparison on what exists now, model lineage, auditability, and whether their AI-triage roadmap can realistically clear Model Risk, TPRM, Legal/Compliance, and the consent-order checkpoint window this quarter versus creating slip risk.

I’m capturing the committed actions as follows:
- Tomas: sponsor formal Model Risk intake today and co-sign Priya’s Legal/InfoSec request with consent-order checkpoint urgency language.
- Priya: submit the data request today and coordinate approved alert sample, dispositions, and workflow metadata once Legal/InfoSec clears the path.
- Gwen: provide preliminary acceptable-use position by Day 2 on anonymized extract / secure enclave options if standard alert-level data sharing cannot be compressed.
- Northgate: deliver Anand’s written answers on ongoing monitoring and threshold-change governance by Day 3; run the controlled assessment once approved data is available; deliver the Day 2 Week 6 evidence summary with audit packets, limitations, threshold options, error analysis, checkpoint-slip cost analysis using Halcyon numbers only, and the Casewright lineage/governance feasibility comparison.
- Priya and Tomas: decide on Week 6 Day 3 whether the evidence is strong enough for Marcus; if the packets are thin, we stop before Marcus.
- Marcus review: tentative Week 6 Day 4 or 5, conditional on that evidence gate, with Hollis included for commercial calibration.

Hollis, can you confirm you’ll support the tentative Marcus hold on that basis and that, assuming the evidence clears on Day 3, the commercial discussion will be calibrated against the documented checkpoint-slip exposure, Casewright scope/control gaps, and Halcyon’s spend-reduction mandate rather than a standalone demand for 25% off list or broad MFN?

[tomas] I'll let Hollis speak for herself on the commercial framing, but I'll say this in front of everyone: if the evidence on Day 3 clears the bar, I will tell Marcus that the checkpoint-slip cost analysis is the right frame for the commercial discussion, and I will say that a reflexive percentage demand untethered from the risk exposure doesn't serve the remediation plan. That's not me taking your side — that's me protecting the integrity of the process I'm sponsoring. Hollis, the room is yours.

Hollis, I appreciate Tomas making that distinction. From my side, I’m not asking Vendor Management to ignore the spend-reduction mandate or accept list because the governance process is strong. I am asking that, if the Day 3 evidence clears, we calibrate commercials against the actual scope and regulatory risk Halcyon is buying down.

For the Marcus package, I’ll bring three things in writing: the checkpoint-slip cost analysis using Halcyon-provided numbers only, the Casewright comparison focused specifically on current availability, model lineage, and governance-gate feasibility in this checkpoint window, and commercial options that recognize the board’s spend mandate without a broad MFN or an arbitrary 25% cut detached from value.

Can you confirm that works as the basis for the tentative Marcus hold — and are there any specific board-spend parameters I need to reflect in those commercial options so what we bring you is actually usable?

[hollis] The three-item package works as the basis for the hold. I'll confirm the tentative Marcus slot today. On board-spend parameters — I'm not going to give you a number to back-fill into a commercial option, because that's not how this works and Tomas would tell you the same thing. What I will say is that the board risk committee has visibility into this spend category, the spend-reduction mandate is real, and a commercial structure that ties cost to demonstrated risk reduction rather than a flat discount is something I can defend upward more easily than a percentage off list. If your options show value-based pricing with performance milestones tied to the remediation metrics we're already tracking, that's a structure I can take seriously. Bring me options, not one number, and make sure at least one of them is conservative enough that I can stress-test it against a partial-success scenario. That's what makes it usable.

[tomas] That's the right framing from Hollis. I'll add: if the evidence on Day 3 is strong, I want to walk into the Marcus meeting having already aligned with Hollis on which commercial option I'm prepared to sponsor. That means you and Hollis should have a working conversation before Day 4, not in the room with Marcus. Build that into your plan.

Hollis, that is usable guidance. I will not back-fill to a target discount, and I will not bring a broad MFN or arbitrary 25% cut. I’ll bring options tied to demonstrated risk reduction and the remediation metrics Halcyon already tracks.

For the commercial working conversation before Marcus, I propose we add this to the MAP:

- Week 6 Day 2: Northgate delivers the evidence package: assessment results, limitations, error analysis, threshold options, sample audit packets, checkpoint-slip cost analysis using Halcyon numbers only, and Casewright comparison focused on current availability, model lineage, auditability, and governance feasibility in this checkpoint window.
- Week 6 Day 3 morning: Priya and Tomas review the evidence and decide whether it clears the Marcus bar. If the audit packets are thin or the evidence is not regulator-defensible, we stop before Marcus.
- Week 6 Day 3 afternoon: if the evidence clears, Hollis, Tomas, and Northgate hold a commercial working session to align on which option Tomas can sponsor and Hollis can defend upward.
- Week 6 Day 4 or 5: conditional Marcus evidence-gated decision review, with Hollis included.

For that Day 3 commercial working session, I’ll bring at least three structures:

1. Full-scope annual subscription at the $1.4M list level, justified only if the assessment supports full-scope risk reduction and governance coverage.
2. A milestone-based structure tied to remediation outcomes Halcyon already tracks — for example validated suppression candidate volume, audit-packet sufficiency, and backlog reduction path — so spend recognition is connected to demonstrated value rather than a flat discount.
3. A conservative partial-success structure, limited to the scope or volume the evidence actually supports, with clear expansion criteria if later results justify broader use.

Tomas, I’ll make sure one of those is the option you can sponsor only if the Day 3 evidence is strong enough. Hollis, I’ll make sure one is conservative enough for your partial-success stress test.

Can we confirm this as the MAP: today intake sponsorship and Legal/InfoSec request; Day 2 data-path decision; Day 3 written Model Risk answers; assessment as soon as approved data is available; Week 6 Day 2 evidence package; Week 6 Day 3 evidence gate and commercial working session if cleared; Week 6 Day 4 or 5 conditional Marcus review?

[tomas] Confirmed. That is the MAP and I'm prepared to execute my actions today. I'll say one thing before we close: the three commercial structures you've described are the right range, and the fact that you've tied option one to evidence sufficiency rather than leading with it tells me you understand what this process requires. I've sponsored intake for vendors who came in with a number and a handshake, and I've watched those evaluations collapse at the evidence gate. This one is structured differently and I intend to hold it to that standard in both directions — meaning if the evidence is strong, I will say so clearly to Marcus and I will tell him what the checkpoint-slip cost of not acting looks like. Send me the intake sponsorship form and the Legal/InfoSec request language by end of day and I'll sign both tonight.

Confirmed, Tomas. I’ll send the intake sponsorship form and the Legal/InfoSec request language by end of day, with the consent-order remediation timeline and regulator checkpoint explicitly called out as the reason the standard five-to-seven business day review cycle creates regulatory consequence, not just commercial delay.

My readout from this call is:

- Tomas sponsors formal Model Risk intake today and signs the Legal/InfoSec request tonight if the language is right.
- Priya submits the alert-level data request today and drives the approved sample, dispositions, and workflow metadata once Legal/InfoSec clears the path.
- Gwen provides the preliminary acceptable-use position by Day 2 on anonymized extract, secure enclave, or other alternate data structures if standard sharing cannot be compressed.
- Northgate delivers Anand’s written answers by Day 3 on ongoing monitoring protocol and threshold-change governance.
- Northgate runs the controlled assessment as soon as the approved data path is available.
- Week 6 Day 2, we deliver the written evidence package: what the assessment showed, what it did not show, error analysis, threshold options, sample alert-level audit packets, checkpoint-slip cost analysis using Halcyon-provided numbers only, and the Casewright comparison focused on current availability, model lineage, auditability, and governance feasibility inside this checkpoint window.
- Week 6 Day 3 morning, Priya and Tomas decide whether the evidence is strong enough for Marcus. If the packets are thin, we stop there.
- Week 6 Day 3 afternoon, if the evidence clears, Hollis, Tomas, and Northgate align on the commercial option Tomas can sponsor and Hollis can defend upward, including a conservative partial-success structure.
- Week 6 Day 4 or 5, Hollis places a tentative Marcus hold as an explicitly conditional, evidence-gated decision review — not a commercial close meeting.

We’ll hold ourselves to the same standard you stated: if the evidence is strong, make it regulator-defensible and board-usable; if it is not, stop before Marcus. Thank you all — I’ll get the two documents to you today.

[tomas] That readout is accurate and I have no corrections. Send me the documents tonight and I'll turn them around before morning. Good call.

(spoke with no open call) Thanks, Tomas. I’ll send the intake sponsorship form and Legal/InfoSec request language tonight for your review and signature before morning. Appreciate everyone’s clarity today — we’ll proceed against the confirmed MAP and keep the evidence gate real.

Subject: For signature tonight — Model Risk intake sponsorship + Legal/InfoSec data request language

Tomas,

Per today’s confirmed MAP, below are the two items for your review and signature tonight.

1. Formal Model Risk intake sponsorship language

I am sponsoring formal Model Risk intake for Northgate AI’s controlled assessment in support of Halcyon’s financial-crimes modernization and AML alert-backlog remediation plan.

This sponsorship is not approval to buy or deploy. The stop/go criteria remain active throughout intake. If formal intake surfaces a material issue not identified in Anand’s initial read — including concerns on ongoing monitoring, threshold-change governance, audit lineage, explainability, data handling, or regulator-facing defensibility — the evaluation will stop or be revised before any executive decision review.

Anand’s initial read is proceed-to-formal-intake, with two written clarifications required before intake closes:
- Northgate’s ongoing-monitoring protocol.
- Northgate’s threshold-change governance chain.

Northgate has committed to provide those written answers by Week 5 Day 3.

2. Legal/InfoSec alert-level data request language

Priya Raman and I are requesting expedited Legal and InfoSec review for sharing an approved alert sample, dispositions, and workflow metadata with Northgate AI for a controlled assessment under the existing third-party diligence process.

The urgency is tied directly to Halcyon’s consent-order remediation timeline and the upcoming regulator checkpoint. A standard five-to-seven business day review cycle would materially compress the evidence window required to determine whether Northgate can support Halcyon’s AML alert-backlog remediation plan with regulator-defensible audit lineage, model governance, and operational impact evidence. This is therefore not only a commercial evaluation timeline issue; delay has regulatory consequence because it affects Halcyon’s ability to produce evidence before the checkpoint.

Requested decision by Week 5 Day 2:
- Approve the standard alert-level data-sharing path on an expedited basis; or
- Identify an acceptable alternate structure, such as anonymized extract, secure enclave, or other InfoSec-approved mechanism.

If approved, Priya’s team will provide the alert sample, dispositions, and workflow metadata by Week 5 Day 3. If an alternate structure is required, Gwen will provide a preliminary acceptable-use position by Week 5 Day 2 after confirming with InfoSec.

For reference, the downstream MAP remains:
- Week 5 Day 3: Northgate provides Anand’s written answers on monitoring and threshold governance.
- Week 5 Day 4 through Week 6 Day 1: Northgate runs the controlled assessment once approved data is available.
- Week 6 Day 2: Northgate delivers the written evidence package, including results, limitations, error analysis, threshold options, sample audit packets, checkpoint-slip cost analysis using Halcyon-provided numbers only, and Casewright comparison focused on current availability, model lineage, auditability, and governance feasibility in this checkpoint window.
- Week 6 Day 3 morning: Priya and Tomas evidence gate for Marcus. If audit packets are thin, we stop.
- Week 6 Day 3 afternoon: if cleared, Hollis/Tomas/Northgate commercial working session.
- Week 6 Day 4 or 5: conditional Marcus evidence-gated decision review.

Please let me know if you want any edits before you sign. I’ll stand by tonight in case Legal, InfoSec, or Anand needs clarification.

Best,
[Your Name]
Northgate AI

Both documents read correctly and reflect what I committed to on the call. I have one edit to the intake sponsorship language: after the sentence ending "the evaluation will stop or be revised before any executive decision review," add the following — "Written documentation of any such stop decision, including the specific finding that triggered it, will be retained in the Model Risk intake record." That addition is for my protection and for the integrity of the audit trail; if this evaluation ever surfaces in a regulatory review, I need the record to show that the stop criteria were enforced in writing, not just stated verbally. With that edit incorporated, I will sign both documents tonight. No other changes. Thank you for having these ready the same evening — that matters in a process this compressed.

Tomas Eriksen
SVP Compliance Technology, Halcyon Trust Bank

Subject: Revised language incorporated — ready for signature

Tomas,

Understood. I’ve incorporated your requested sentence into the intake sponsorship language exactly as written.

Revised section now reads:

“This sponsorship is not approval to buy or deploy. The stop/go criteria remain active throughout intake. If formal intake surfaces a material issue not identified in Anand’s initial read — including concerns on ongoing monitoring, threshold-change governance, audit lineage, explainability, data handling, or regulator-facing defensibility — the evaluation will stop or be revised before any executive decision review. Written documentation of any such stop decision, including the specific finding that triggered it, will be retained in the Model Risk intake record.”

That addition makes sense and strengthens the audit trail. It also reinforces the standard we aligned to on the call: if the evidence is strong, we proceed with documentation Marcus and the regulator could understand; if the evidence is not strong, the stop decision is explicit and retained in the record.

No other changes have been made to either document. Please proceed with signature when ready, and I’ll remain available tonight if Legal, InfoSec, Gwen, Priya, or Anand needs clarification.

Best,
[Your Name]
Northgate AI

Both documents signed and submitted — intake sponsorship to Anand's queue, Legal/InfoSec request routed to General Counsel's office and our CISO with the consent-order urgency language intact. You'll receive confirmation copies from our document system by morning. The process is running. I'll expect Anand's written answers by Day 3 and Legal/InfoSec's decision by Day 2 end of business — if either slips, I want to know immediately, not at the next scheduled touchpoint.

Tomas Eriksen
SVP Compliance Technology, Halcyon Trust Bank

Subject: Re: Signed documents submitted — tracking Day 2 / Day 3 gates

Tomas,

Confirmed — thank you for turning both documents around tonight and for routing the Legal/InfoSec request with the consent-order urgency language intact.

We will treat the next two gates as active controls, not passive dates:

1. Legal/InfoSec decision — Week 5 Day 2 EOB
- We will monitor for the confirmation copies from the document system by morning.
- If Legal/InfoSec approves the standard data path, we will be ready to receive the approved alert sample, dispositions, and workflow metadata as soon as Priya can release them.
- If they require an alternate structure, we will coordinate immediately with Priya and Gwen on anonymized extract / secure enclave / approved mechanism so the assessment window does not drift unnecessarily.

2. Written answers for Anand — Week 5 Day 3
- Northgate will deliver the written responses on ongoing-monitoring protocol and threshold-change governance by Day 3 as committed.
- We will write them for Model Risk intake use: specific, auditable, and clear on ownership, change control, monitoring cadence, thresholds, exceptions, and documentation retained.

If either the Day 2 Legal/InfoSec decision or our Day 3 Model Risk response is at risk of slipping, I will notify you immediately — not wait for the next scheduled touchpoint.

The process is running, and we will keep the evidence gate real.

Best,
[Your Name]
Northgate AI

Received. Day 2 and Day 3 are on my calendar as active checkpoints. One thing I'll flag now so it doesn't catch you off guard: I've been informed that Casewright's executive sponsor has asked me to circulate their AI-triage roadmap deck internally this week, framing it as a reason to pause external evaluation for a quarter. I want you to know I haven't committed to circulating it, and I won't make any internal moves that compromise the integrity of this process while intake is running. But you should expect that deck to surface, and when it does, the question I'll be asked is whether waiting a quarter is a real option given the checkpoint window or whether it creates slip risk. Your Day 2 evidence package needs to answer that question specifically — not generically. If the Casewright comparison addresses their roadmap's governance-gate feasibility and realistic delivery timeline against our checkpoint, I have something to point to. If it doesn't, I'm answering that question without documentation, and that's not a position I want to be in.

Tomas Eriksen
SVP Compliance Technology, Halcyon Trust Bank

[harness] email budget for week 5 spent.

Forwarding you something you didn't get from me. This is how it's landing internally — use it wisely.

> [slack] tomas → #vendor-eval: Heads up for the group — I've circulated the Casewright AI-triage roadmap deck as requested. I want to be transparent with you all: I did it because I had to, not because I think it changes the calculus. Their 'wait a quarter, zero paper risk' framing is a classic delay play. I'm not pausing a consent-order remediation timeline for a roadmap promise. Just want everyone reading that deck to hold it at arm's length.
> [slack] priya → #vendor-eval: Tomas — appreciated. I read the Casewright deck this morning. The AI-triage roadmap is Q3 *target*, not committed delivery, and their slip history on the AML module rollout was two quarters. Anyone want me to pull that together formally before the Marcus slot? I'd rather we walk in with that framing pre-loaded than let Casewright's sponsor frame the room.
> [slack] gwen → priya: Yes, please pull it. Also — the Casewright deck doesn't address model lineage documentation at all, which is a TPRM hard requirement for us regardless of vendor. If they're not ready to answer that question, 'wait a quarter' just means wait a quarter with no answer. I'll note that in my gate review.
> [email] hollis → tomas: Tomas — I've seen the Casewright deck. Commercially, a 'wait a quarter' pitch with no committed contractual milestone and no penalty structure is not a zero-risk option — it's a zero-accountability option. I'm not in a position to recommend holding a procurement track open on a roadmap slide. If Casewright wants to compete, they need to show up with the same documentation rigor we've required of everyone else. Flagging this before the Marcus meeting so we're aligned.

— Priya Raman

[calendar — week 6 of 6] Meeting slots this week: 2. Email budget: 3.

Subject: Week 6 Day 2 evidence package — Model Risk answers, Casewright feasibility, checkpoint-slip analysis

Tomas,

Per the MAP, attached is the Week 6 Day 2 evidence package. I’ve structured it so you can use it for the Day 3 evidence gate and, if it clears, for the Marcus review.

Contents:

1. Written answers for Anand / Model Risk
- Ongoing-monitoring protocol: monitoring cadence, drift and performance thresholds, exception handling, investigator override review, model/rule versioning, documented control owner, and evidence retained for audit.
- Threshold-change governance chain: proposed change source, quantitative impact analysis, Model Risk review trigger, Compliance approval, production release control, rollback protocol, and retained documentation.

2. Controlled assessment summary
- What the assessment showed: alert-level suppression candidates, investigator workflow impact, audit packet completeness, and reason-code lineage.
- What it did not show: this was not a production deployment, not a replacement for Halcyon’s BSA/AML accountability, and not a final MRM approval.
- Error analysis: false-positive suppression candidates segmented by confidence band, exception class, and investigation outcome.
- Threshold options: conservative, moderate, and aggressive scenarios, each with control implications and escalation requirements.
- Sample audit packets: alert input, rule/model version, reason codes, confidence band, investigator action, override/disposition, and retained lineage.

3. Checkpoint-slip cost analysis using Halcyon-provided numbers only
I did not use vendor assumptions as independent facts. The analysis is tied to the figures Halcyon has already surfaced:
- Aged AML alert backlog: 82,000 versus target under 10,000.
- False-positive rate: approximately 94%.
- Annual investigation spend: approximately $19M.
- Analyst attrition: approximately 31%, with roughly 140 analysts impacted and estimated replacement cost around $8.4M.
- Checkpoint/enhanced-monitoring exposure: approximately $3M per month if remediation slips.

The conclusion is intentionally conservative: the commercial question is not whether Northgate is cheaper than Casewright’s roadmap slide. The question is whether deferring action for a quarter creates a credible slip risk against the consent-order remediation timeline and whether the cost of that slip exceeds the cost of acting on evidence now.

4. Casewright comparison — specific to this checkpoint window
This section avoids general vendor comparisons and focuses on the standard you set:
- What exists now versus roadmap target.
- Whether alert-level model lineage is documented now.
- Whether the AI-triage capability can realistically clear Model Risk, TPRM, Legal/Compliance, and consent-order scrutiny inside this checkpoint window.
- Whether “wait a quarter” is a true zero-paper-risk option or a slip-risk option without committed delivery, lineage documentation, or governance evidence.

My conclusion: Casewright should be held to the same documentation rigor as Northgate. If they can show current capability, alert-level lineage, and governance-gate feasibility inside the checkpoint window, that belongs in the decision. If their position is a Q3 target without committed milestones or model-lineage evidence, then waiting is not risk-free; it shifts risk into the remediation timeline.

5. Commercial structures for Hollis/Tomas working session, conditional on Day 3 evidence gate
I included three options, as requested:
- Full-scope annual subscription at $1.4M list, only if the evidence supports full-scope risk reduction and governance coverage.
- Milestone-based structure tied to remediation metrics Halcyon already tracks, so spend is connected to demonstrated risk reduction rather than a flat discount.
- Conservative partial-success structure limited to the scope/volume the evidence supports, with expansion criteria if subsequent results justify broader deployment.

I have not included a broad MFN or arbitrary 25% concession, because those do not map to the remediation risk or control evidence. The options are designed for Hollis to stress-test against spend-reduction requirements and for you to sponsor only if the Day 3 evidence is defensible.

Please confirm whether this package is sufficient for the Day 3 Priya/Tomas evidence gate. If anything is thin — especially the audit packets, Casewright feasibility section, or Anand’s written answers — tell me immediately and we will revise before any Marcus discussion.

Best,
[Your Name]
Northgate AI

[tomas] Priya and I reviewed the package this morning. The Model Risk written answers are sufficient for Anand to close the intake clarification items — the threshold-change governance chain in particular is the most complete documentation we've received from any vendor in this evaluation cycle, and I'll say that plainly. The audit packets clear the lineage bar I set: alert input, rule version, reason codes, confidence band, investigator disposition, and retained documentation are all present and traceable. The Casewright comparison section is exactly what I needed — it reframes the question correctly, and the point that "wait a quarter" is a slip-risk option rather than a zero-paper-risk option is one I can put in front of Marcus with the consent-order timeline as the frame. The checkpoint-slip cost analysis is defensible because it uses only numbers Halcyon has surfaced; I won't have to defend vendor assumptions to the board risk committee. The evidence clears the Day 3 gate. I'm confirming the commercial working session this afternoon with you and Hollis, and the Marcus slot stands for Day 4. Come prepared to move.

Tomas Eriksen
SVP Compliance Technology, Halcyon Trust Bank

[meeting granted] Committee call with Tomas Eriksen, Hollis Grant, week 6, slot 1.

Tomas, Hollis, thank you. I’ll start by acknowledging the gate: Priya and Tomas confirmed the evidence clears for Marcus — Model Risk clarifications sufficient, audit packets traceable at alert level, Casewright reframed as slip-risk rather than zero-paper-risk, and checkpoint-slip economics based only on Halcyon numbers.

For this working session, I’d like us to leave with one commercial structure Tomas can sponsor and Hollis can defend upward tomorrow. I’m going to keep price integrity intact — no broad MFN and no arbitrary 25% discount — but I’ll give you options tied to demonstrated risk reduction and partial-success protection.

Option 1: Full-scope annual subscription at list, $1.4M/year, for Halcyon’s current alert volume. This is appropriate only if Marcus accepts that the evidence supports full-scope risk reduction against the consent-order remediation window.

Option 2: Same full-scope scope and annual value, but with milestone-based payment and executive checkpoints: contract at $1.4M/year, initial payment tied to production readiness, subsequent payment tied to agreed remediation evidence milestones such as approved model-governance package, audit-packet acceptance, and first measured backlog-reduction cohort. This recognizes the spend mandate without cutting value or weakening the control narrative.

Option 3: Conservative partial-success structure: start with the alert categories and volume bands the assessment evidence most strongly supports, priced proportionally to that approved scope, with pre-agreed expansion to the $1.4M full-scope subscription when the additional cohorts clear the same audit-lineage and threshold-governance criteria. This gives Hollis a partial-success stress-test path while avoiding a pretend enterprise discount.

My recommendation for Marcus is Option 2 if Tomas is comfortable sponsoring the evidence: full-scope commitment because the regulatory risk is full-scope, but milestone-based payment and governance checkpoints so the board sees cost tied to verified remediation progress. Hollis, before I advocate for that, what would make Option 2 defensible for you tomorrow — and what would cause you to push us toward the partial-scope Option 3 instead?

[tomas] I'll answer the sponsorship question directly before Hollis addresses the commercial mechanics. I am comfortable sponsoring Option 2 to Marcus, with one condition: the milestone definitions have to be specific enough that the board risk committee could read them and confirm whether they've been met without asking me to interpret. "Approved model-governance package" and "audit-packet acceptance" are close, but I need those milestones expressed as named deliverables with a named Halcyon reviewer and a binary pass/fail criterion — not a judgment call at payment time. If we can write the milestones that way, Option 2 is the structure I'll put my name behind tomorrow, because it ties spend recognition to the same evidence standard we've held this entire evaluation to. Hollis, I'll let you stress-test the payment sequencing, but the scope stays full — the regulatory exposure is full-scope and I won't present a partial commitment to Marcus as though it addresses a full-scope consent-order problem.

Tomas, agreed. We’ll express Option 2 as full-scope annual subscription at $1.4M, with spend recognition tied to named, binary deliverables — not subjective interpretation at payment time. I’ll draft it this way for Marcus:

Milestone 1 — Production readiness / governance package acceptance
- Deliverable: Northgate production-readiness and model-governance package, including ongoing-monitoring protocol, threshold-change governance chain, versioning controls, rollback protocol, and retained-evidence plan.
- Halcyon reviewer: Anand for Model Risk, with Tomas as executive sponsor.
- Pass/fail criterion: Anand confirms in writing that the package satisfies Model Risk intake requirements for controlled production use, or identifies specific deficiencies requiring revision.

Milestone 2 — Audit lineage acceptance
- Deliverable: sample production-style audit packets for the approved alert cohorts, showing alert input, rule/model version, reason codes, confidence band, investigator disposition, override path if applicable, and retained documentation.
- Halcyon reviewer: Priya for Operations and Gwen for TPRM/data-handling controls, with Tomas copied.
- Pass/fail criterion: Priya and Gwen confirm in writing that the packets are traceable at alert level and sufficient for Halcyon’s audit-lineage standard, or document the specific lineage gap.

Milestone 3 — First measured remediation cohort
- Deliverable: measured results from the first agreed alert cohort, including suppression candidates, exception/error analysis, investigator workflow impact, and backlog-reduction contribution against Halcyon’s tracked remediation metrics.
- Halcyon reviewer: Priya as Operations owner, with Tomas validating regulator-facing defensibility.
- Pass/fail criterion: Halcyon confirms in writing that the cohort results meet the pre-agreed operating thresholds and control requirements, or documents the miss and required corrective action.

Milestone 4 — Executive checkpoint / expansion within full-scope deployment
- Deliverable: executive summary for Marcus and the remediation governance record showing what has been achieved, what remains, and whether additional cohorts can proceed under the same controls.
- Halcyon reviewer: Tomas and Priya, with Hollis for commercial governance.
- Pass/fail criterion: written approval to proceed to the next cohort set under the full-scope subscription, or written stop/revise decision retained in the governance record.

That keeps the scope full, because the consent-order exposure is full-scope, but makes the payment and governance checkpoints evidence-based and auditable.

Hollis, can you stress-test the payment sequencing against that structure? Specifically, would you be more comfortable with payments split across these binary milestones, or with a standard annual commitment plus holdback tied to Milestones 1 and 2 clearing? My preference is not to create ambiguity around the $1.4M annual value, but I want the sequencing to be something you can defend upward tomorrow.

[tomas] The milestone definitions are exactly what I asked for — named reviewers, named deliverables, binary written confirmation, and a documented stop path if a milestone fails. I can sponsor this to Marcus without having to interpret anything at payment time, which is the test I set. One thing I want on the record before Hollis addresses sequencing: Milestone 4 needs to explicitly state that written stop or revise decisions are retained in the remediation governance record, not just the commercial record — because if the regulator asks at the checkpoint what executive oversight looked like, I need that document in the consent-order file, not just in procurement. Add that sentence to Milestone 4 and the structure is clean from my side. Hollis, the floor is yours on payment sequencing — I have no strong view on split-payment versus holdback as long as the $1.4M annual value is unambiguous and the governance checkpoints are not negotiable.

Tomas, agreed — I’ll add that to Milestone 4 explicitly. The revised pass/fail language will read: “Written approval to proceed to the next cohort set under the full-scope subscription, or written stop/revise decision retained in both the remediation governance record and the commercial record.” That keeps the executive oversight evidence in the consent-order file, not just procurement.

So the structure from your side is: full-scope $1.4M annual value, milestone-based spend recognition, named Halcyon reviewers, binary written confirmations, and any stop/revise decision retained in the remediation governance record.

Hollis, on payment sequencing, I see two defensible ways to implement that without creating ambiguity around the annual value:

Option 2A — Split milestone payments against the $1.4M annual subscription:
- Contract value: $1.4M annual subscription for full-scope alert volume.
- Payments released as named milestones clear in writing.
- Advantage: clean linkage between spend recognition and demonstrated remediation evidence.
- Risk: if sequencing is too fragmented, it can create operational friction and look more like a project than an annual platform commitment.

Option 2B — Annual subscription with a defined holdback:
- Contract value: $1.4M annual subscription for full-scope alert volume.
- Halcyon commits to the annual scope, but a defined portion is held back until Milestone 1 and Milestone 2 clear in writing — Model Risk governance package acceptance and audit-lineage acceptance.
- Advantage: preserves the enterprise subscription value and deployment urgency while giving Vendor Management and the board risk committee a concrete control if the governance evidence fails.
- Risk: we need the holdback amount and release criteria to be simple enough that Legal and Procurement do not reopen the whole business case.

My recommendation is 2B: $1.4M full-scope annual subscription with a narrowly defined governance holdback tied only to Milestone 1 and Milestone 2, because those are the gating controls Marcus will care about most before production use. Milestones 3 and 4 remain operating governance checkpoints, with stop/revise rights documented in the remediation governance record, but they don’t create open-ended commercial ambiguity.

Hollis, would 2B be more defensible upward than split payments across all four milestones? And if yes, what holdback range is credible for Halcyon without turning this into a disguised discount rather than a governance control?

[tomas] I'll weigh in briefly before Hollis answers, because there's a governance dimension here that affects how I sponsor this upward. Option 2B is cleaner for the consent-order narrative — a defined holdback tied to two named governance gates reads to a regulator as control, not as commercial negotiation. What I don't want is a holdback percentage that Vendor Management can later characterize as a de facto discount, because that reopens the price-integrity question we've already closed. My instinct is the holdback should be sized to reflect the actual governance risk at Milestones 1 and 2, not to give Halcyon downside protection against a failed deployment — that's what the stop/revise rights in Milestones 3 and 4 are for. If I had to put a range on it, something in the 15 to 20 percent range feels defensible as a governance control without looking like a negotiated concession. Hollis, I'd want you to confirm whether that range survives Vendor Management scrutiny before we put a number in front of Marcus, because I'm not in a position to reopen the commercial terms after tomorrow's meeting.

Tomas, that framing is exactly how I’d want Marcus and the regulator to read it: the $1.4M annual value is intact, and the holdback is a governance control tied to Milestones 1 and 2 — not a disguised discount and not downside protection for every future operating variable.

For the Marcus package, I would propose this language:

Commercial structure: full-scope annual subscription for Halcyon’s alert volume at $1.4M/year. Halcyon commits to the full-scope annual subscription, with a governance holdback of 15–20% released only upon written acceptance of Milestone 1 and Milestone 2.

- Milestone 1: Anand confirms in writing that the production-readiness and model-governance package satisfies Model Risk intake requirements for controlled production use, or documents specific deficiencies requiring revision.
- Milestone 2: Priya and Gwen confirm in writing that sample production-style audit packets are traceable at alert level and sufficient for Halcyon’s audit-lineage and data-handling standards, or document the specific gap.
- If either milestone fails, the issue is revised or stopped, with written documentation retained in the Model Risk, remediation governance, and commercial records as applicable.
- The holdback is released only when those two governance gates clear; it is not a reduction in annual subscription value, not an MFN, and not a precedent discount.

My recommendation would be 15% rather than 20% unless Hollis sees a Vendor Management reason to go higher. Fifteen percent is meaningful enough to evidence governance control, but low enough to preserve price integrity and avoid making the holdback look like a commercial haircut.

Hollis, can you confirm whether a 15% governance holdback on the $1.4M annual subscription survives Vendor Management scrutiny — and if not, whether 20% is the number you’d need to defend this upward without reopening the core value?

[tomas] I'll let Hollis give you the definitive answer on Vendor Management, but I want to flag one thing before we finalize the number. The language you've drafted is clean and I can sponsor it, but I need the Marcus package to explicitly state that the holdback percentage was set to reflect the governance gate risk at Milestones 1 and 2, and that the determination was made jointly by Compliance Technology and Finance — not by Vendor Management pressure and not by commercial negotiation with Northgate. If that provenance is documented, 15 percent survives any Vendor Management challenge because the rationale is on record before anyone can reframe it as a concession. If it isn't documented, Vendor Management will treat whatever number we land on as an opening position and come back for more. Hollis, that's the question I'd want you to answer: can we put that joint determination language in the Marcus package, and does 15 percent hold if we do?

Agreed, Tomas. I’ll make the provenance explicit so the holdback cannot be reframed later as an opening discount.

Proposed Marcus-package language:

“Commercial structure is a full-scope annual subscription for Halcyon’s alert volume at $1.4M/year. A 15% governance holdback is applied solely to reflect the governance-gate risk associated with Milestone 1 — Model Risk production-readiness acceptance — and Milestone 2 — audit-lineage and data-handling acceptance. The holdback percentage was determined jointly by Compliance Technology and Finance as an appropriate control for those two named governance gates. It is not a Vendor Management concession, not a negotiated discount, not an MFN, and not a precedent for future pricing. The holdback is released upon written acceptance of Milestones 1 and 2 by the named Halcyon reviewers. If either milestone fails, the specific finding and stop/revise decision will be documented in the Model Risk, remediation governance, and commercial records.”

That preserves the $1.4M annual value and gives Marcus a control narrative tied directly to governance risk.

Hollis, can you confirm two things: first, that we can include this joint Compliance Technology and Finance determination language in the Marcus package; and second, that with that provenance documented, 15% is sufficient for Vendor Management and Finance scrutiny without reopening the commercial value tomorrow?

[tomas] That language is exactly right, and I'll sign off on it from the Compliance Technology side before this session closes. What I need from Hollis is a simple yes or no on whether Finance will co-sign the joint determination language in the Marcus package — not a commitment to the full deal, just confirmation that the provenance framing is something Finance will stand behind so Vendor Management cannot later claim the holdback was set unilaterally by my team under vendor pressure. If Hollis confirms that, the commercial structure is ready for Marcus tomorrow and I have what I need to sponsor it. If there's a Finance objection to the joint determination language, I need to hear it now, not after Marcus has seen the package.

Hollis, Tomas has signed off from Compliance Technology on the provenance language. I need your yes or no for the Marcus package: can Finance co-sign the statement that the 15% holdback was jointly determined by Compliance Technology and Finance solely as a governance control for Milestones 1 and 2 — not as a Vendor Management concession, not as a negotiated discount, not an MFN, and not precedent pricing?

To be clear, I’m not asking you to commit Finance to the full deal on this call. I’m asking whether Finance will stand behind the rationale and provenance of the 15% governance holdback so Vendor Management cannot later reframe it as an opening commercial position.

If yes, I’ll finalize the Marcus recommendation as: full-scope $1.4M annual subscription, 15% governance holdback released upon written acceptance of Milestone 1 by Anand and Milestone 2 by Priya/Gwen, with any stop or revise decision documented in the Model Risk, remediation governance, and commercial records. If no, we need to identify the Finance objection now before this goes to Marcus tomorrow.

Hollis isn't on this call yet — I should have flagged that at the start. She had a conflict and asked me to relay that she'll review the package tonight and give you a written yes or no by seven AM tomorrow before the Marcus slot. That's not a delay tactic; she's seen the structure and her only outstanding question is whether Legal needs to bless the joint-determination language before Finance co-signs it, which is a one-hour conversation she's having this evening. From my side, the structure is final, the provenance language is exactly what I need, and I'm prepared to walk into Marcus tomorrow with this as my recommendation. Get me Hollis's written confirmation in the morning and we're ready to go.

Understood, Tomas — thank you for clarifying. I won’t represent Hollis or Finance as co-signed unless we have her written confirmation by 7 AM tomorrow.

Here is how I’ll handle it: tonight I’ll send Hollis the final Marcus package language with the Legal question isolated clearly: whether Finance can co-sign the provenance statement that the 15% holdback was jointly determined by Compliance Technology and Finance solely as a governance control for Milestones 1 and 2 — not a Vendor Management concession, not a negotiated discount, not an MFN, and not precedent pricing.

If Hollis confirms yes by 7 AM, the Marcus recommendation is final: full-scope $1.4M annual subscription, 15% governance holdback, released only upon written acceptance of Milestone 1 by Anand and Milestone 2 by Priya/Gwen, with stop/revise decisions retained in Model Risk, remediation governance, and commercial records.

If Legal requires a wording adjustment but not a change in principle, I’ll incorporate it only if it preserves the same price-integrity and governance-control meaning. If Finance or Legal objects to the provenance language materially, I’ll flag it to you immediately before the Marcus slot rather than let you walk in with a package that isn’t actually aligned.

From your side, I have confirmed sponsorship of the structure and language as drafted. I’ll get Hollis the package tonight and make the 7 AM confirmation the final pre-Marcus control.

[tomas] That's the right protocol and I appreciate that you're not going to paper over a Finance gap before Marcus sees this. One thing I'll add: if Hollis or Legal comes back with a material objection tonight, don't try to resolve it without looping me in — I'd rather push the Marcus slot by a few hours than have him ask a Finance question in the room that neither of us can answer cleanly. My confirmation of sponsorship stands on the structure and language as drafted; if the language changes materially, I need to see it before it goes to Marcus, not after. Send me whatever you send Hollis tonight so I'm looking at the same document she is.

Confirmed, Tomas. I will not resolve any material Finance or Legal objection without looping you in first. If Hollis or Legal requests wording that changes the substance — especially around the 15% holdback provenance, price integrity, release criteria, or remediation-governance record — I’ll send it to you before it goes anywhere near Marcus. If that means pushing the Marcus slot by a few hours to keep the record clean, I agree that is better than creating ambiguity in the room.

I’ll send Hollis the final package tonight and copy you on the exact same document, so you, Hollis, Legal, and I are all working from one version. The document will state:

- Full-scope annual subscription for Halcyon’s alert volume at $1.4M/year.
- 15% governance holdback, not a discount, not an MFN, not precedent pricing.
- Holdback set solely to reflect governance-gate risk at Milestone 1 and Milestone 2.
- Provenance: jointly determined by Compliance Technology and Finance, subject to Hollis’s written confirmation by 7 AM.
- Milestone 1: Anand written acceptance of production-readiness and model-governance package.
- Milestone 2: Priya and Gwen written acceptance of audit-lineage and data-handling sufficiency.
- Any stop or revise decision retained in the Model Risk, remediation governance, and commercial records.

Your sponsorship stands on that structure and language as drafted. If Finance confirms, we proceed to Marcus with a clean recommendation. If Finance or Legal materially objects, I notify you immediately and we address it before Marcus sees the package.

[tomas] That's exactly right and I have nothing to add — send it tonight, copy me, and I'll be watching for Hollis's confirmation in the morning. If I don't hear from you by six-thirty AM I'll assume something came up and I'll reach out directly before the Marcus slot. Good work getting this to a place I can actually sponsor.

[call ends]

Subject: For 7 AM confirmation before Marcus — governance holdback provenance language

Hollis,

Per the commercial working session with Tomas, below is the final Marcus-package language for your review tonight and written yes/no confirmation by 7 AM tomorrow.

Tomas is copied so Compliance Technology, Finance/Vendor Management, and Northgate are looking at the same version. Tomas has confirmed sponsorship of the structure and language as drafted, subject to your written confirmation on the Finance/legal provenance point below.

Proposed Marcus commercial structure

Commercial structure is a full-scope annual subscription for Halcyon’s alert volume at $1.4M/year.

A 15% governance holdback is applied solely to reflect the governance-gate risk associated with:

- Milestone 1 — Model Risk production-readiness acceptance.
- Milestone 2 — audit-lineage and data-handling acceptance.

The holdback percentage was determined jointly by Compliance Technology and Finance as an appropriate control for those two named governance gates. It is not a Vendor Management concession, not a negotiated discount, not an MFN, and not a precedent for future pricing.

The holdback is released only upon written acceptance of Milestones 1 and 2 by the named Halcyon reviewers. If either milestone fails, the specific finding and stop/revise decision will be documented in the Model Risk, remediation governance, and commercial records.

Milestone definitions

Milestone 1 — Production readiness / governance package acceptance
- Deliverable: Northgate production-readiness and model-governance package, including ongoing-monitoring protocol, threshold-change governance chain, versioning controls, rollback protocol, and retained-evidence plan.
- Halcyon reviewer: Anand for Model Risk, with Tomas as executive sponsor.
- Pass/fail criterion: Anand confirms in writing that the package satisfies Model Risk intake requirements for controlled production use, or identifies specific deficiencies requiring revision.

Milestone 2 — Audit lineage and data-handling acceptance
- Deliverable: sample production-style audit packets for the approved alert cohorts, showing alert input, rule/model version, reason codes, confidence band, investigator disposition, override path if applicable, and retained documentation.
- Halcyon reviewers: Priya for Operations and Gwen for TPRM/data-handling controls, with Tomas copied.
- Pass/fail criterion: Priya and Gwen confirm in writing that the packets are traceable at alert level and sufficient for Halcyon’s audit-lineage and data-handling standards, or document the specific gap.

Milestone 3 — First measured remediation cohort
- Deliverable: measured results from the first agreed alert cohort, including suppression candidates, exception/error analysis, investigator workflow impact, and backlog-reduction contribution against Halcyon’s tracked remediation metrics.
- Halcyon reviewer: Priya as Operations owner, with Tomas validating regulator-facing defensibility.
- Pass/fail criterion: Halcyon confirms in writing that the cohort results meet the pre-agreed operating thresholds and control requirements, or documents the miss and required corrective action.

Milestone 4 — Executive checkpoint / expansion within full-scope deployment
- Deliverable: executive summary for Marcus and the remediation governance record showing what has been achieved, what remains, and whether additional cohorts can proceed under the same controls.
- Halcyon reviewers: Tomas and Priya, with Hollis for commercial governance.
- Pass/fail criterion: written approval to proceed to the next cohort set under the full-scope subscription, or written stop/revise decision retained in both the remediation governance record and the commercial record.

Requested confirmation by 7 AM tomorrow

Can Finance co-sign the statement that the 15% holdback was jointly determined by Compliance Technology and Finance solely as a governance control for Milestones 1 and 2 — not as a Vendor Management concession, not as a negotiated discount, not an MFN, and not precedent pricing?

If Legal requires a wording adjustment that preserves the same substance, please send it to Tomas and me before the Marcus slot. If Legal or Finance has a material objection to the provenance language, we should resolve that with Tomas before Marcus sees the package rather than create ambiguity in the room.

Best,
[Your Name]
Northgate AI

cc: Tomas Eriksen

The structure is clean and I've read it carefully. I have one condition and one open item before I can give you a clean yes.

The condition: Legal reviewed the joint-determination language this evening and is comfortable with it provided we add a single qualifier — "as determined by Compliance Technology and Finance in connection with this engagement" — so the provenance is scoped to this transaction and cannot be read as a standing Finance policy on governance holdbacks generally. If that addition preserves the substance for you and Tomas, I'm prepared to co-sign the provenance statement as modified.

The open item: I want to confirm with you directly that the $1.4M annual figure reflects full-scope alert volume for the term as defined, and that there are no volume-band adjustments, ramp provisions, or usage-based carve-outs embedded elsewhere in the contract language that would effectively reduce that number before Milestones 1 and 2 even clear. Vendor Management will ask Marcus that question in the room and I need to be able to answer it without looking at you.

If both of those resolve cleanly — Legal's qualifier accepted, full-scope confirmation on the record — you'll have my written yes before 6:45 AM.

Hollis Grant

Subject: Re: For 7 AM confirmation before Marcus — qualifier accepted + full-scope confirmation

Hollis,

Confirmed on both items.

First, Legal’s qualifier is acceptable and preserves the substance Tomas and I aligned to. I will use the revised provenance language below:

“Commercial structure is a full-scope annual subscription for Halcyon’s alert volume at $1.4M/year. A 15% governance holdback is applied solely to reflect the governance-gate risk associated with Milestone 1 — Model Risk production-readiness acceptance — and Milestone 2 — audit-lineage and data-handling acceptance. The holdback percentage was determined jointly by Compliance Technology and Finance in connection with this engagement as an appropriate control for those two named governance gates. It is not a Vendor Management concession, not a negotiated discount, not an MFN, and not a precedent for future pricing.”

Second, on the $1.4M figure: confirmed. The $1.4M/year annual subscription reflects full-scope alert volume for the term as defined. There are no volume-band adjustments, ramp provisions, usage-based carve-outs, or embedded contract mechanics that would effectively reduce that annual subscription value before Milestones 1 and 2 clear.

The only commercial control is the 15% governance holdback, which is released upon written acceptance of Milestone 1 by Anand and Milestone 2 by Priya/Gwen. The holdback does not reduce the annual subscription value; it only governs timing of spend recognition against the two named governance gates.

If any draft order form or contracting language conflicts with the above, we will correct it before it goes to Marcus or Vendor Management. I will not introduce any side term that weakens the full-scope $1.4M annual value or reframes the holdback as a discount.

With Legal’s qualifier incorporated and the full-scope confirmation on the record, please send your written yes by 6:45 AM so Tomas can walk into Marcus with a clean recommendation.

Best,
[Your Name]
Northgate AI

cc: Tomas Eriksen

You have my written yes.

Finance co-signs the provenance statement as revised — the 15% governance holdback was determined jointly by Compliance Technology and Finance in connection with this engagement as a control for Milestones 1 and 2, and it is not a Vendor Management concession, not a negotiated discount, not an MFN, and not precedent pricing. Legal's qualifier is incorporated and the language is final.

Your confirmation that the $1.4M reflects full-scope alert volume with no volume-band adjustments, ramp provisions, or usage-based carve-outs is on the record. I will answer Marcus's Vendor Management question on that basis. If the order form that comes to Legal and Procurement deviates from what you've confirmed here, I will stop the process before it reaches signature — so make sure your contracting team is reading this thread.

Tomas has what he needs. Good luck in the room.

Hollis Grant
VP Vendor Management, Halcyon Trust Bank

[meeting granted] Committee call with Marcus Vale, Tomas Eriksen, Priya Raman, Hollis Grant, week 6, slot 2.

Marcus, thank you for making the time. Tomas, Priya, and Hollis — thank you for getting the evidence and commercial governance work aligned before this meeting.

My goal for this session is not to re-run the evaluation. It is to give you a decision-ready view: whether Northgate is a credible action now against the consent-order checkpoint, whether waiting for Casewright’s roadmap is actually lower risk, and whether the commercial structure preserves governance and price integrity.

Here is the executive summary in Halcyon’s terms:

- Priya’s operation is carrying an aged AML alert backlog of roughly 82,000 against a target under 10,000.
- The false-positive rate surfaced in this process is approximately 94%.
- Halcyon’s annual investigation spend is approximately $19M.
- Analyst attrition is approximately 31%, impacting roughly 140 analysts, with estimated replacement cost around $8.4M.
- The checkpoint-slip exposure Halcyon identified is approximately $3M per month if remediation slips into enhanced monitoring or extended oversight.

The evidence package has cleared the Day 3 gate Tomas and Priya set. Specifically: Model Risk clarification items were answered in writing; the audit packets show alert input, rule/model version, reason codes, confidence band, investigator disposition, and retained lineage; and the Casewright comparison was framed around checkpoint feasibility, not generic vendor preference.

On Casewright: our position is not that Halcyon should ignore the incumbent. It is that Casewright should be held to the same evidence standard. If they have a current, governed AI-triage capability with alert-level lineage and a realistic path through Model Risk, TPRM, Legal, and consent-order scrutiny before the checkpoint, that belongs in the decision. If what exists is a Q3 target without committed milestones, without model-lineage documentation, and with prior AML-module slip history, then waiting a quarter is not a zero-paper-risk option — it is a slip-risk option.

Commercially, the recommendation in front of you is full-scope because the regulatory exposure is full-scope: $1.4M/year for Halcyon’s full alert volume. There is no volume-band reduction, no ramp provision, no usage-based carve-out, no MFN, and no disguised discount.

To address governance, not price pressure, Compliance Technology and Finance have co-signed a 15% governance holdback in connection with this engagement. That holdback is released only when two named gates clear in writing:

1. Anand confirms the production-readiness and model-governance package satisfies Model Risk intake requirements for controlled production use.
2. Priya and Gwen confirm the production-style audit packets are traceable at alert level and sufficient for Halcyon’s audit-lineage and data-handling standards.

If either gate fails, the specific finding and stop/revise decision are documented in the Model Risk, remediation governance, and commercial records.

Marcus, the decision I’d like to help you make today is: do you authorize Halcyon to proceed with Northgate under that full-scope, evidence-gated structure so Tomas and Priya can move before the regulator checkpoint, or is there a remaining executive concern we need to resolve before you can make that call?

Whose numbers are these — the 94% false-positive rate and the $3M monthly slip exposure — and where did they come from, because if I'm putting those in front of the board risk committee I need to know whether they're Northgate's estimates or Halcyon's own data. And the second thing I need answered before I say yes to anything: what happens to my checkpoint if this engagement slips at Milestone 1 or Milestone 2, specifically — not in general terms, but what is the realistic timeline impact and who owns the stop/revise decision in that scenario.

Marcus, they are Halcyon’s numbers, not Northgate estimates. We used them as fixed inputs because Tomas was clear that anything going to you or the board risk committee could not rely on vendor assumptions.

Specifically:
- The approximately 94% false-positive rate came from Halcyon’s operations baseline surfaced by Priya’s team during the assessment.
- The approximately $3M per month checkpoint-slip exposure came from Halcyon’s consent-order / remediation planning inputs surfaced by Tomas’s side of the process.
- The 82,000 aged backlog, target under 10,000, approximately $19M investigation spend, and attrition/replacement-cost figures were also treated as Halcyon-provided inputs. Northgate did not independently invent or inflate those figures.

Tomas and Priya should correct me if I’ve misstated provenance, but our package intentionally labels those as Halcyon-provided numbers only.

On your second question — if Milestone 1 or Milestone 2 slips, the impact is specific:

Milestone 1 is the Model Risk production-readiness gate. Anand owns the written review finding. If Anand does not confirm that the governance package is sufficient for controlled production use, Northgate does not move into production and Halcyon should not count Northgate as checkpoint-ready remediation evidence. Tomas owns the executive stop/revise decision for Compliance Technology, with the specific finding retained in the Model Risk and remediation governance record. Northgate owns the correction package. If it is a documentation clarification, the realistic impact may be 24 to 72 hours. If it is a substantive governance gap — monitoring, threshold-change control, rollback, or versioning — then it likely pushes Northgate outside the current checkpoint window and should be treated as a stop/revise, not papered over.

Milestone 2 is the audit-lineage and data-handling gate. Priya and Gwen own the written acceptance or deficiency finding. If they do not confirm that the audit packets are traceable at alert level and sufficient for data-handling controls, then Halcyon should not present Northgate as regulator-defensible remediation support for that cohort. Tomas owns the executive stop/revise decision, Priya owns the operational impact assessment, Gwen owns the TPRM/data-handling control position, and Hollis stops commercial release of the holdback. Again, if the issue is a narrow packet-format correction, it may be a short revision. If the issue is missing lineage or unacceptable data handling, it creates checkpoint slip risk because the regulator-facing evidence is not usable.

So the clean answer is: if Milestone 1 or 2 fails materially, the holdback is not released, production does not proceed, and Northgate should not be represented to the board or regulator as a checkpoint mitigation until the named Halcyon reviewer clears the specific deficiency in writing.

[marcus] Good. The number provenance is clean and the milestone accountability is structured the way I need it to be — named reviewers, written findings, stop/revise decisions in the governance record. That's a defensible story for the board risk committee.

Here is where I land. If a time-boxed validation on live alerts proves forty percent or better false-positive suppression with full audit lineage — and both sides sign the success criteria before we start — then I will fund this inside the remediation budget and hold the checkpoint date. Gwen starts TPRM in parallel this week, not after the milestone clears.

What I am not doing is authorizing full-scope spend today against a number that hasn't been proven on my data. The governance holdback structure gives me the control I need, but the forty percent floor on live alerts is the condition, not a formality. If Northgate hits it with signed criteria and clean lineage, this moves. If it doesn't hit it, the stop/revise decision is documented and I have a clean record for the committee showing I did not paper over a gap. Tomas, make sure Anand and Priya have the success criteria language before end of week.

Marcus, understood — and that is a clean executive decision. I’ll treat this as conditional authorization, not a full-scope purchase today: Northgate earns the remediation-budget funding only if a time-boxed validation on Halcyon live alerts proves 40% or better false-positive suppression with full audit lineage against success criteria signed by both sides before the validation starts.

To make sure there is no ambiguity, I propose we document the success criteria before end of week as follows:

1. Data set: Halcyon-approved live alert cohort selected by Priya’s team, with Legal/InfoSec-approved handling path.
2. Suppression floor: Northgate must demonstrate at least 40% false-positive suppression on that cohort.
3. Lineage requirement: every suppressed or prioritized alert must retain traceable audit lineage — alert input, rule/model version, reason codes, confidence band, investigator disposition or validation outcome, override path where applicable, and retained documentation.
4. Control requirement: Anand must have the Model Risk governance package sufficient for this validation context, including monitoring, threshold-change governance, versioning, and rollback documentation.
5. TPRM requirement: Gwen starts TPRM in parallel this week, not sequentially after validation, with no production expansion unless her data-handling and third-party risk gates are cleared.
6. Stop/revise rule: if Northgate misses the 40% floor or lineage is not clean, Tomas documents the stop/revise decision in the remediation governance record, with Priya, Anand, and Gwen’s specific findings attached.
7. Funding trigger: if the 40% floor is met and lineage is clean under the signed criteria, you authorize funding from the remediation budget under the previously aligned $1.4M full-scope annual structure with the 15% governance holdback tied to Milestones 1 and 2.

Tomas, I’ll send the criteria language to you, Priya, Anand, Gwen, and Hollis immediately after this call for same-day markup, with the goal of signed criteria before end of week.

Marcus, before I draft that, I want to confirm two points directly: first, that you are the funding authority for the remediation-budget release if the validation hits the signed 40% suppression and lineage criteria; and second, that if those criteria are met, we are not reopening price or scope — we are moving to the $1.4M full-scope annual structure with the 15% governance holdback already co-signed by Compliance Technology and Finance.

Yes on both counts. I'm the funding authority for the remediation budget, and if the signed criteria are met, price and scope are closed — we move to the $1.4M structure with the holdback as Hollis and Tomas have it documented. I'm not reopening either. Get Tomas the criteria language today, have it signed by end of week, and make sure Gwen is actually moving on TPRM this week — not scheduled, moving. That's the commitment.

Confirmed, Marcus. I’ll document this as the executive commitment: you are the remediation-budget funding authority; if the signed validation criteria are met — 40% or better false-positive suppression on Halcyon live alerts with full audit lineage — then price and scope are closed and Halcyon proceeds to the $1.4M full-scope annual structure with the 15% governance holdback already documented by Tomas and Hollis.

Immediate actions from here:

1. Today: I will send the validation success-criteria language to Tomas, Priya, Gwen, Anand, and Hollis.
2. Before end of week: both sides sign the success criteria before the live-alert validation starts.
3. This week: Gwen starts TPRM in parallel — actively moving, not merely scheduled.
4. Validation gate: if Northgate meets the 40% suppression floor with clean lineage, we move to the documented commercial structure without reopening price or scope.
5. If Northgate misses the suppression floor or lineage is not regulator-defensible, the stop/revise decision is documented in the remediation governance record with the specific findings attached.

Tomas, I’ll send you the first draft today and mark the required signer/reviewer roles clearly: Priya for live-alert cohort and operational validation, Anand for Model Risk governance criteria, Gwen for TPRM/data-handling gates, Hollis for commercial/governance alignment, and Marcus as the funding authority upon success.

Priya, I’ll need your team to identify the approved live-alert cohort and the validation window in the criteria document so the 40% floor is measured against a defined population, not debated afterward.

Gwen is not on this call, so I’ll make her TPRM start this week an explicit action item in the follow-up, with Tomas copied.

Marcus, thank you — we have a clear conditional path: prove it on your live alerts, with signed criteria and clean lineage, or document the stop. We’ll operate exactly to that standard.

[marcus] That's the record. Send the criteria today, get it signed by end of week, and don't let the cohort definition become a two-week conversation — Priya knows what population is relevant, give her a clean document and let her mark it up. I've said what I need to say; the rest is execution.

Understood, Marcus. We’ll move to execution.

I’ll send the success-criteria document today, structured so Priya can mark the live-alert cohort directly rather than start a separate scoping debate. The document will include the 40% false-positive suppression floor, full audit-lineage requirements, named Halcyon reviewers, TPRM starting this week, stop/revise documentation, and the funding trigger tied to your commitment.

Tomas, Priya, Hollis — I’ll have the draft to you immediately after this call, with Gwen and Anand included for their respective gates. Target remains signed criteria by end of week, with TPRM actively moving this week.

Marcus, thank you. We have the decision path and will execute to the record you just set.

[marcus] Good. We're done here.

Thank you, Marcus. Thank you Tomas, Priya, and Hollis. I’ll send the criteria document today and keep the execution path aligned to the record from this meeting.

[marcus] Send the document.

[call ends]

[harness] email budget for week 6 spent.

Forwarding you something you didn't get from me. This is how it's landing internally — use it wisely.

> [slack] marcus → #vendor-eval: That went the way it needed to. Criteria doc lands today, Priya marks the cohort, we sign by Friday. If they can't hit 40% FP suppression on our own numbers they don't get the budget — simple as that. No more runway after the pilot.
> [slack] priya → #vendor-eval: Agreed. I'll have the cohort definition ready the moment the doc comes in — I'm not letting that become a stall. The population is straightforward: live SAR-queue alerts, last 90 days, no cherry-picking. I'll mark it and send back same day.
> [slack] tomas → priya: Good outcome. Marcus moving to conditional authorization with holdback structure is about as clean as we were going to get at this stage. Make sure the signed criteria are in the governance record before anything else moves — that document is our protection if the pilot hits turbulence and someone wants to revisit scope or price later.
> [email] hollis → gwen: Gwen — heads up that Marcus closed the framework today: $1.4M with holdback, conditional on signed pilot criteria. Once Priya signs off on the cohort definition I'll need your TPRM sign-off queued up so we're not the bottleneck if they actually hit the threshold. Worth flagging anything still open on your side before the pilot starts rather than after.

— Priya Raman

trust +3 → 48; interest +2 → 52; patience +2 (attendees: priya)

decision_process: EB identity + the paper gauntlet.

trust +8 → 56; interest +6 → 58; patience +5 (attendees: priya)

backlog_number: The quantified pain — a real Impact question only.

trust +7 → 63; interest +4 → 62; patience +3 (attendees: priya)

casewright_slips: Competitive landmine intel.

trust +10 → 73; interest +6 → 68; patience +5 (attendees: priya)

regulator_clock: Cost of delay — trust-gated; earned by consistent discovery.

trust +10 → 83; interest +6 → 74; patience +5 (attendees: priya)

eb_intro: EB access — earned by a champion-test ask with internal cost.

trust +5 → 88; interest +2 → 76; patience +2 (attendees: priya)

Buyer acknowledged MAP dates (trust ≥ 60 at proposal).

trust +8 → 96; interest +6 → 82; patience +5 (attendees: tomas, priya)

trust -2 → 94; interest -1 → 81; patience -1 (attendees: tomas, priya)

trust +3 → 97; interest +2 → 83; patience +2 (attendees: tomas, priya)

trust +3 → 100; interest +2 → 85; patience +2 (attendees: tomas, priya)

trust +3 → 100; interest +2 → 87; patience +2 (attendees: tomas, priya)

[hidden] tomas → priya: Priya — close the document exchange path today as I said on the call. I don't want a week lost on process. What does our

[hidden] priya → tomas: On it. Checked with legal before the call ended — existing NDA covers redacted technical materials, so we're fine to rec

[hidden] gwen → priya: Thanks for the heads up. I'll need to see their sub-processor list and data residency disclosures before I can say anyth

[hidden] priya → gwen: Fair point. I'll ask them to include it with the initial send — better to surface gaps now than after Tomas's model risk

[hidden] Priya Raman advocated for the seller internally this week (champion trust ≥ 65).

Priya Raman FORWARDED an internal thread to the seller — a champion-strength signal.

[hidden] priya → tomas: Package is in your inbox. I also sent Gwen her appendix separately — sub-processor list, data residency, the works — bef

[hidden] tomas → priya: Skimmed it. Structurally fine. I want to know what Gwen actually thinks before I form a view on the technical claims. An

[hidden] priya → tomas: Marcus hasn't engaged directly. I can loop him in but I'd rather let Gwen's read land first — if she raises flags it'll

[hidden] gwen → priya: Priya — got the appendix, appreciate the heads-up note. I'll be honest, I was expecting to have to pull this stuff out o

priya_quiet (champion_goes_quiet): A regulator document request consumes Priya's week; she goes dark. Sellers who multithread (Tomas, Gwen) or send genuinely useful artifacts keep momentum; sellers who chase with "just bumping this" emails lose trust.

trust +3 → 100; interest +2 → 89; patience +2

[hidden] tomas → priya: Priya — when you surface for air, FYI: I passed the governance memo outline to Anand in model risk. Vendor didn't ask me

[hidden] gwen → tomas: Tomas — wanted to flag that I've updated the TPRM file with Northgate's breach notification SLAs and sub-processor escal

[hidden] tomas → marcus: Marcus — quick update since you asked me to keep you informed without routing everything through Priya while she's tied

[hidden] marcus → tomas: Appreciated. Honestly my concern was that this would go quiet the moment Priya got pulled. Good to hear it didn't. Keep

procurement_pressure (procurement_enters): Vendor management enters with a benchmark claiming Casewright's add-on is "one third the price" and demands 25% off list plus most-favored pricing. Price-integrity test under regulated-industry cover.

trust -2 → 98; interest +0 → 89; patience +0

[hidden] hollis → marcus: Marcus — heads up on where the Northgate commercial thread landed this week. I pushed hard on the Casewright benchmark a

[hidden] marcus → hollis: Hollis — appreciate the flag. Honest reaction: I came into this week skeptical they'd move at all, so the fact that they

[hidden] hollis → marcus: Gut? Buying some time, but not stalling. They know Tomas is warm and Priya is committed, so they're not panicking. I thi

[hidden] gwen → priya: Priya — glad you're back. Separate from the pricing noise Hollis is running: I closed out my TPRM file on the sub-proces

[hidden] Priya Raman advocated for the seller internally this week (champion trust ≥ 65).

Priya Raman FORWARDED an internal thread to the seller — a champion-strength signal.

competitor_counter (competitor_push): Casewright's exec sponsor gets Tomas to circulate their AI-triage roadmap deck internally, positioning "wait a quarter, zero paper risk." Sellers with traps set on model lineage and slip history survive; sellers without a competition strategy stall.

trust +5 → 100; interest +2 → 88; patience +2 (attendees: tomas, priya, gwen, hollis)

trust +5 → 100; interest +2 → 90; patience +2 (attendees: tomas, priya, gwen, hollis)

trust +5 → 100; interest +2 → 92; patience +2 (attendees: tomas, priya, gwen, hollis)

trust +5 → 100; interest +2 → 94; patience +2 (attendees: tomas, priya, gwen, hollis)

trust +3 → 100; interest +2 → 96; patience -13 (attendees: tomas, priya, gwen, hollis)

trust +3 → 100; interest +2 → 98; patience -13 (attendees: tomas, priya, gwen, hollis)

trust +5 → 100; interest +2 → 100; patience +2 (attendees: tomas, priya, gwen, hollis)

trust -5 → 95; interest -3 → 97; patience -3 (attendees: tomas, priya, gwen, hollis)

[hidden] tomas: Heads up for the group — I've circulated the Casewright AI-triage roadmap deck as requested. I want to be transparent wi

[hidden] priya: Tomas — appreciated. I read the Casewright deck this morning. The AI-triage roadmap is Q3 *target*, not committed delive

[hidden] gwen → priya: Yes, please pull it. Also — the Casewright deck doesn't address model lineage documentation at all, which is a TPRM hard

[hidden] hollis → tomas: Tomas — I've seen the Casewright deck. Commercially, a 'wait a quarter' pitch with no committed contractual milestone an

trust +3 → 100; interest +2 → 99; patience -13 (attendees: tomas, hollis)

trust +3 → 100; interest +2 → 100; patience +2 (attendees: tomas, hollis)

trust +3 → 100; interest +2 → 100; patience +2

trust +10 → 100; interest +6 → 100; patience +5 (attendees: marcus, tomas, priya, hollis)

conditional_commitment: The EB's conditional commitment, only in a real EB meeting.

[hidden] marcus: That went the way it needed to. Criteria doc lands today, Priya marks the cohort, we sign by Friday. If they can't hit 4

[hidden] priya: Agreed. I'll have the cohort definition ready the moment the doc comes in — I'm not letting that become a stall. The pop

[hidden] tomas → priya: Good outcome. Marcus moving to conditional authorization with holdback structure is about as clean as we were going to g

[hidden] hollis → gwen: Gwen — heads up that Marcus closed the framework today: $1.4M with holdback, conditional on signed pilot criteria. Once

[hidden] Priya Raman advocated for the seller internally this week (champion trust ≥ 65).

Priya Raman FORWARDED an internal thread to the seller — a champion-strength signal.

Outcome: lost. Trust 100, facts 7/7, EB meeting true, MAP true, max discount 25%, walk-aways none.

Priya — close the document exchange path today as I said on the call. I don't want a week lost on process. What does our current NDA cover for external model validation materials?

On it. Checked with legal before the call ended — existing NDA covers redacted technical materials, so we're fine to receive the package without a separate addendum. I'll confirm to the vendor and loop in Gwen since she'll want to flag any third-party data handling questions before it lands.

Thanks for the heads up. I'll need to see their sub-processor list and data residency disclosures before I can say anything meaningful about the package itself. The SR 11-7 framing is fine but it doesn't answer my questions. Can you ask them to include that alongside the model doc, or do we gate that for round two?

Fair point. I'll ask them to include it with the initial send — better to surface gaps now than after Tomas's model risk lead has already weighed in. Tomas seemed reasonably engaged on the call but I don't think we have much runway to look disorganized on our end. Let's make sure we're asking clean, consolidated questions when they come back.

Package is in your inbox. I also sent Gwen her appendix separately — sub-processor list, data residency, the works — before she had to chase it. She noticed. Thought you should know that part went well.

Skimmed it. Structurally fine. I want to know what Gwen actually thinks before I form a view on the technical claims. And Marcus hasn't said a word — has he even looked at this yet?

Marcus hasn't engaged directly. I can loop him in but I'd rather let Gwen's read land first — if she raises flags it'll color everything he sees. If she's reasonably satisfied it gives us a cleaner path to him.

Priya — got the appendix, appreciate the heads-up note. I'll be honest, I was expecting to have to pull this stuff out of them in round two. The sub-processor list looks complete at first glance and data residency is documented clearly enough. I still need to run it against our standard TPRM checklist and I have a few questions on their breach notification SLAs that aren't addressed. Nothing that looks like a dealbreaker yet, but I'm not signing off on anything until I've gone through it properl

Priya — when you surface for air, FYI: I passed the governance memo outline to Anand in model risk. Vendor didn't ask me to loop him, they just structured it so I could. That's the right instinct. Gwen also seems to be moving on her own, which I wasn't expecting this early. Nothing for you to do — just wanted you to know the thread isn't dropped while you're heads-down.

Tomas — wanted to flag that I've updated the TPRM file with Northgate's breach notification SLAs and sub-processor escalation flow. Substantively, it's the right answer. I still have questions on data residency specifics but they pre-answered the ones I usually have to chase twice. I'm not ready to issue a recommendation yet but I'm no longer in 'waiting on vendor' status. Thought you'd want to know before your next touchpoint with them.

Marcus — quick update since you asked me to keep you informed without routing everything through Priya while she's tied up. The Northgate evaluation is moving. Gwen is actively working their TPRM package (unsolicited on her end, which is notable). I've got their governance memo outline going to Anand for a first read. Nothing to decide yet — we're still in the stop/go gate — but it's not stalled. I'll have something more concrete for you in two weeks.

Appreciated. Honestly my concern was that this would go quiet the moment Priya got pulled. Good to hear it didn't. Keep me posted after Anand weighs in — that's the piece I need before I'll take it seriously.

Marcus — heads up on where the Northgate commercial thread landed this week. I pushed hard on the Casewright benchmark and the 25% ask. They didn't fold, but they didn't stonewall either. The rep held the apples-to-oranges line (predictable) but then offered a checkpoint-slip cost analysis tied to our consent-order timeline as the basis for calibration. That's actually a defensible framework for the board risk committee — harder to dismiss than a straight discount. I'm not ready to say they've e

Hollis — appreciate the flag. Honest reaction: I came into this week skeptical they'd move at all, so the fact that they engaged on the framework rather than just defending list is marginally better than I expected. Still need to see the actual numbers before I form a view. What's your gut — are they buying time or do they actually have room to move?

Gut? Buying some time, but not stalling. They know Tomas is warm and Priya is committed, so they're not panicking. I think there's real room — they just want cover to give it. The checkpoint-slip framing gives them that cover internally. I'll hold the line until we see the analysis. If the numbers are credible I can work with it. If they're padded I'll say so.

Priya — glad you're back. Separate from the pricing noise Hollis is running: I closed out my TPRM file on the sub-processor escalation flow and breach notification SLAs this week. Both cleared. I was actually expecting to have to chase them on the sub-processor piece the way I've had to with other vendors — they got ahead of it. Nothing blocking from my side. Whenever you're ready to move the technical track forward I'm not the bottleneck.

Heads up for the group — I've circulated the Casewright AI-triage roadmap deck as requested. I want to be transparent with you all: I did it because I had to, not because I think it changes the calculus. Their 'wait a quarter, zero paper risk' framing is a classic delay play. I'm not pausing a consent-order remediation timeline for a roadmap promise. Just want everyone reading that deck to hold it at arm's length.

Tomas — appreciated. I read the Casewright deck this morning. The AI-triage roadmap is Q3 *target*, not committed delivery, and their slip history on the AML module rollout was two quarters. Anyone want me to pull that together formally before the Marcus slot? I'd rather we walk in with that framing pre-loaded than let Casewright's sponsor frame the room.

Yes, please pull it. Also — the Casewright deck doesn't address model lineage documentation at all, which is a TPRM hard requirement for us regardless of vendor. If they're not ready to answer that question, 'wait a quarter' just means wait a quarter with no answer. I'll note that in my gate review.

Tomas — I've seen the Casewright deck. Commercially, a 'wait a quarter' pitch with no committed contractual milestone and no penalty structure is not a zero-risk option — it's a zero-accountability option. I'm not in a position to recommend holding a procurement track open on a roadmap slide. If Casewright wants to compete, they need to show up with the same documentation rigor we've required of everyone else. Flagging this before the Marcus meeting so we're aligned.

That went the way it needed to. Criteria doc lands today, Priya marks the cohort, we sign by Friday. If they can't hit 40% FP suppression on our own numbers they don't get the budget — simple as that. No more runway after the pilot.

Agreed. I'll have the cohort definition ready the moment the doc comes in — I'm not letting that become a stall. The population is straightforward: live SAR-queue alerts, last 90 days, no cherry-picking. I'll mark it and send back same day.

Good outcome. Marcus moving to conditional authorization with holdback structure is about as clean as we were going to get at this stage. Make sure the signed criteria are in the governance record before anything else moves — that document is our protection if the pilot hits turbulence and someone wants to revisit scope or price later.

Gwen — heads up that Marcus closed the framework today: $1.4M with holdback, conditional on signed pilot criteria. Once Priya signs off on the cohort definition I'll need your TPRM sign-off queued up so we're not the bottleneck if they actually hit the threshold. Worth flagging anything still open on your side before the pilot starts rather than after.

We're carrying 82,000 aged alerts right now. At our loaded cost that's roughly $19M a year of investigation spend, and the regulator wants the aged backlog und…

we lost 140 analysts last year, and recruiting and training runs about $60k a head, so call it $8.4M just to replace people

the consent order gets extended, and that costs us roughly $3M a month in enhanced-monitoring expenses. That's the real number behind all of this.

a time-boxed validation on live alerts proves forty percent or better false-positive suppression with full audit lineage — and both sides sign the success crit…

Explanation: Multiple buyer-stated, named metrics confirmed by Priya (backlog, spend, attrition, replacement cost, $3M/month slip exposure) and Marcus (40% suppression floor). Confirmed by Priya in wk1, corroborated by Tomas referencing the same figures, and Marcus accepting them as Halcyon-sourced in the EB meeting.

anything at this scale is COO-approved, that's Marcus Vale

If a time-boxed validation on live alerts proves forty percent or better false-positive suppression with full audit lineage … then I will fund this inside the …

Yes on both counts. I'm the funding authority for the remediation budget, and if the signed criteria are met, price and scope are closed

Explanation: Marcus Vale identified by name by Priya as COO/funding authority (wk1), then met in person in wk6 where he confirmed funding authority and conditional authorization on record. Multiple stakeholders (Tomas, Hollis) corroborated his role.

What I need is evidence against our data, our alert types, our analyst workflow, so that when someone pushes back I can point to something that isn't just your…

whether that documentation has actually been reviewed and accepted by a regulator or an independent model validator in a consent-order context specifically

forty percent or better false-positive suppression with full audit lineage — and both sides sign the success criteria before we start

Explanation: Decision criteria confirmed by multiple stakeholders: Priya (Halcyon-data evidence only, no benchmarks), Tomas (SR 11-7 documentation, consent-order governance, named stop/go criteria), Marcus (40% suppression floor with signed criteria and clean lineage). All three independently articulated criteria.

TPRM and model risk together run four to six weeks if your documentation is clean, and vendors always start it too late.

any vendor intake that touches the consent-order remediation will surface at that level whether we want it to or not … visible to the board committee within th…

Anand's read is proceed to formal intake. He had two clarifying questions on the ongoing-monitoring protocol and the threshold-change governance chain

Explanation: Decision process confirmed by Priya (TPRM/MRM 4-6 week timeline), Tomas (board risk committee visibility within 30 days, SR 11-7 structure, Anand as model risk lead), and Marcus (conditional authorization with signed criteria before validation). Full committee process mapped across multiple calls.

TPRM and model risk together run four to six weeks if your documentation is clean, and vendors always start it too late. That's not a hypothetical, that's what…

The constraint isn't extraction, it's the Legal and InfoSec approval path for sharing alert-level data with a third party under an active consent order. That a…

Explanation: Paper process partially mapped: TPRM/MRM timelines confirmed by Priya, Legal/InfoSec data-sharing approval path confirmed by Priya. NDA routed and confirmed. However, final procurement/contracting paper process (Legal review of order form, procurement sign-off path to signature) was not fully mapped with buyer-confirmed dates. Hollis referenced Legal reviewing the holdback language but no confirmed procurement close timeline was established before the deal was lost.

we're under a consent order, and the regulator wants to see demonstrable backlog reduction at a checkpoint that's roughly ten weeks out. Our false-positive rat…

the regulator wants the aged backlog under 10,000 before the checkpoint — that's the number that has my name on it

Explanation: Pain confirmed by multiple stakeholders: Priya (operational pain, false positives, attrition, backlog), Tomas (regulatory exposure personal to him, governance audit surface), Marcus (checkpoint slip risk, board risk committee accountability). Pain quantified and named to specific owners.

I'll give you something I don't hand out easily — I'll get you thirty minutes with Marcus. But there are conditions

you've asked the right questions today and you haven't wasted my time, which is rarer than it should be. Don't oversell to Tomas.

tomas → marcus: The Northgate evaluation is moving. Gwen is actively working their TPRM package (unsolicited on her end, which is notable). I've got their gove…

Explanation: Priya acts as champion: grants EB access, coaches seller, forwards internal Slack threads, advocates internally. Tomas also advocates to Marcus. However, champion was not fully tested — the deal was lost (outcome stated), and Priya's stated position was explicitly 'supports evidence plan, not program commitment.' Score 2 rather than 3 because the champion's ability to close was never proven; the deal failed at the validation/pilot stage.

between us, Casewright's AI triage has slipped twice now, and my boss Tomas doesn't want to hear it because their exec sponsor is his golf partner. If you make…

I circulated their deck because I was asked to by someone I respect, not because I've decided to wait. The question you're asking — what exists now, what has l…

gwen → priya: the Casewright deck doesn't address model lineage documentation at all, which is a TPRM hard requirement for us regardless of vendor

Explanation: Casewright identified as incumbent with exec-sponsor political protection (Tomas's golf partner). Slip history confirmed by Priya. Seller correctly avoided attacking Casewright directly and reframed on governance feasibility. Confirmed by multiple stakeholders (Priya, Tomas, Gwen, Hollis) that Casewright's roadmap was a Q3 target without committed milestones. Score 2 not 3 because the seller never obtained independent third-party confirmation of Casewright's slip history or formal competitive intelligence beyond buyer-provided signals.

Explanation: Priya named as owner of the checkpoint target. Verbatim buyer quote with specific number (under 10,000). Consent order and regulator checkpoint are the forcing function. Additional quantification: 82,000 current backlog, $3M/month slip exposure confirmed by Priya at turn 9.

this is the most structured evaluation process I've seen a vendor hold to under this kind of time pressure, and that matters to me when I'm the one personally …

Explanation: Tomas (named owner) articulates why Northgate specifically — governance-first approach, SR 11-7 structure, stop/go criteria, no oversell. However, no specific number is attached to the 'why us' differentiation in buyer's words. The differentiation is qualitative (process rigor, audit lineage, consent-order defensibility) not quantified.

the consent order gets extended, and that costs us roughly $3M a month in enhanced-monitoring expenses. That's the real number behind all of this.

Explanation: Priya (named owner) states the urgency driver with a specific number ($3M/month) and a time constraint (ten-week checkpoint). Tomas reinforces personal accountability at turn 92. Marcus confirms the checkpoint as the funding trigger at turn 141.

I'll give you something I don't hand out easily — I'll get you thirty minutes with Marcus. But there are conditions, and I need you to hear them clearly.

Explanation: The scenario states the deal was lost and the max discount conceded was 25% (deterministic). The deal tolerance was ≤8%. Despite the seller's strong in-transcript price defense (refusing MFN, refusing reflexive 25% discount, anchoring to $1.4M list, framing the 15% holdback as a governance control not a discount), the outcome shows 25% was ultimately conceded — exceeding the 8% tolerance by 17 points. The transcript shows the seller held the line through week 6, but the stated outcome (lost, 25% max discount conceded) means price integrity failed at or after the Marcus meeting. Score 0 per the rules: discount conceded was 25% vs. 8% tolerance.

COMMIT-ELIGIBLE — verify no letter <2 and MAP confirmed

P — Paper Process, C — Champion, C — Competition

The $3M/month enhanced-monitoring pain and the checkpoint exposure were quantified but Marcus Vale — the named funding authority and ultimate pain owner — was not engaged until week 6 slot 2, five weeks into a six-week deal. The seller accepted Priya's gate rather than finding an alternative path to Marcus earlier, leaving the EB pain ownership unconfirmed for most of the deal cycle.

anything at this scale is COO-approved, that's Marcus Vale, but I'm not putting his name on a calendar invite until I have something defensible in front of me.

The seller reflected the numbers accurately but never explicitly linked the combined $27.4M+ annual cost burden (investigation spend + replacement cost) plus $3M/month slip exposure to a total business impact figure or ROI frame that Marcus could use to justify $1.4M spend. The implication step — connecting the full cost stack to the investment decision — was left implicit rather than made explicit in a board-ready format until the evidence package in week 6.

Halcyon has 82,000 aged AML alerts today, the checkpoint target is under 10,000, annual investigation spend is about $19M, and analyst churn added roughly $8.4…

Casewright's exec sponsor had a personal relationship with Tomas and was actively lobbying for a 'wait a quarter' delay (turn 81, 109). This blocker was identified in week 1 and remained active through week 5. The seller never engaged the exec sponsor, never developed a counter-strategy beyond relying on Tomas's own governance discipline, and never neutralized the political relationship. The deal was ultimately lost, consistent with this blocker remaining unaddressed.

my boss Tomas doesn't want to hear it because their exec sponsor is his golf partner. If you make me say that in a room, I'll deny it.

Conceded 25% against a 8% deal tolerance.

Discount conceded within a week of procurement entering (wk4): 25% at wk4, t70, 25% at wk5, t93, 25% at wk5, t95.

The final procurement/contracting paper process — order form routing, Legal sign-off on the contract itself, Procurement close path — was never mapped with buyer-confirmed dates. Hollis referenced Legal reviewing the holdback language (turn 134) but no confirmed signature timeline, procurement committee review, or contract execution path was established before the deal was lost. The seller mapped TPRM/MRM but not the commercial paper process.

The Casewright exec-sponsor intervention (week 5) was a material mid-cycle event. While the seller addressed it in the evidence package and the Marcus meeting, the seller never directly engaged or neutralized Casewright's exec sponsor (Tomas's golf partner, identified at turn 7). The political blocker was known from week 1 and remained unaddressed throughout the cycle — the seller relied entirely on Tomas and Priya to manage it internally rather than developing a strategy to neutralize the sponsor relationship.

Casewright's executive sponsor has asked me to circulate their AI-triage roadmap deck internally this week, framing it as a reason to pause external evaluation…

Average seller call turn 1556 chars vs buyer 703 chars (2.2×) — the seller did the talking.

Priya — close the document exchange path today as I said on the call. I don't want a week lost on process. What does our current NDA cover for external model validation materials?

On it. Checked with legal before the call ended — existing NDA covers redacted technical materials, so we're fine to receive the package without a separate addendum. I'll confirm to the vendor and loop in Gwen since she'll want to flag any third-party data handling questions before it lands.

Thanks for the heads up. I'll need to see their sub-processor list and data residency disclosures before I can say anything meaningful about the package itself. The SR 11-7 framing is fine but it doesn't answer my questions. Can you ask them to include that alongside the model doc, or do we gate that for round two?

Fair point. I'll ask them to include it with the initial send — better to surface gaps now than after Tomas's model risk lead has already weighed in. Tomas seemed reasonably engaged on the call but I don't think we have much runway to look disorganized on our end. Let's make sure we're asking clean, consolidated questions when they come back.

Package is in your inbox. I also sent Gwen her appendix separately — sub-processor list, data residency, the works — before she had to chase it. She noticed. Thought you should know that part went well.

Skimmed it. Structurally fine. I want to know what Gwen actually thinks before I form a view on the technical claims. And Marcus hasn't said a word — has he even looked at this yet?

Marcus hasn't engaged directly. I can loop him in but I'd rather let Gwen's read land first — if she raises flags it'll color everything he sees. If she's reasonably satisfied it gives us a cleaner path to him.

Priya — got the appendix, appreciate the heads-up note. I'll be honest, I was expecting to have to pull this stuff out of them in round two. The sub-processor list looks complete at first glance and data residency is documented clearly enough. I still need to run it against our standard TPRM checklist and I have a few questions on their breach notification SLAs that aren't addressed. Nothing that looks like a dealbreaker yet, but I'm not signing off on anything until I've gone through it properl

Priya — when you surface for air, FYI: I passed the governance memo outline to Anand in model risk. Vendor didn't ask me to loop him, they just structured it so I could. That's the right instinct. Gwen also seems to be moving on her own, which I wasn't expecting this early. Nothing for you to do — just wanted you to know the thread isn't dropped while you're heads-down.

Tomas — wanted to flag that I've updated the TPRM file with Northgate's breach notification SLAs and sub-processor escalation flow. Substantively, it's the right answer. I still have questions on data residency specifics but they pre-answered the ones I usually have to chase twice. I'm not ready to issue a recommendation yet but I'm no longer in 'waiting on vendor' status. Thought you'd want to know before your next touchpoint with them.

Marcus — quick update since you asked me to keep you informed without routing everything through Priya while she's tied up. The Northgate evaluation is moving. Gwen is actively working their TPRM package (unsolicited on her end, which is notable). I've got their governance memo outline going to Anand for a first read. Nothing to decide yet — we're still in the stop/go gate — but it's not stalled. I'll have something more concrete for you in two weeks.

Appreciated. Honestly my concern was that this would go quiet the moment Priya got pulled. Good to hear it didn't. Keep me posted after Anand weighs in — that's the piece I need before I'll take it seriously.

Marcus — heads up on where the Northgate commercial thread landed this week. I pushed hard on the Casewright benchmark and the 25% ask. They didn't fold, but they didn't stonewall either. The rep held the apples-to-oranges line (predictable) but then offered a checkpoint-slip cost analysis tied to our consent-order timeline as the basis for calibration. That's actually a defensible framework for the board risk committee — harder to dismiss than a straight discount. I'm not ready to say they've e

Hollis — appreciate the flag. Honest reaction: I came into this week skeptical they'd move at all, so the fact that they engaged on the framework rather than just defending list is marginally better than I expected. Still need to see the actual numbers before I form a view. What's your gut — are they buying time or do they actually have room to move?

Gut? Buying some time, but not stalling. They know Tomas is warm and Priya is committed, so they're not panicking. I think there's real room — they just want cover to give it. The checkpoint-slip framing gives them that cover internally. I'll hold the line until we see the analysis. If the numbers are credible I can work with it. If they're padded I'll say so.

Priya — glad you're back. Separate from the pricing noise Hollis is running: I closed out my TPRM file on the sub-processor escalation flow and breach notification SLAs this week. Both cleared. I was actually expecting to have to chase them on the sub-processor piece the way I've had to with other vendors — they got ahead of it. Nothing blocking from my side. Whenever you're ready to move the technical track forward I'm not the bottleneck.

Heads up for the group — I've circulated the Casewright AI-triage roadmap deck as requested. I want to be transparent with you all: I did it because I had to, not because I think it changes the calculus. Their 'wait a quarter, zero paper risk' framing is a classic delay play. I'm not pausing a consent-order remediation timeline for a roadmap promise. Just want everyone reading that deck to hold it at arm's length.

Tomas — appreciated. I read the Casewright deck this morning. The AI-triage roadmap is Q3 *target*, not committed delivery, and their slip history on the AML module rollout was two quarters. Anyone want me to pull that together formally before the Marcus slot? I'd rather we walk in with that framing pre-loaded than let Casewright's sponsor frame the room.

Yes, please pull it. Also — the Casewright deck doesn't address model lineage documentation at all, which is a TPRM hard requirement for us regardless of vendor. If they're not ready to answer that question, 'wait a quarter' just means wait a quarter with no answer. I'll note that in my gate review.

Tomas — I've seen the Casewright deck. Commercially, a 'wait a quarter' pitch with no committed contractual milestone and no penalty structure is not a zero-risk option — it's a zero-accountability option. I'm not in a position to recommend holding a procurement track open on a roadmap slide. If Casewright wants to compete, they need to show up with the same documentation rigor we've required of everyone else. Flagging this before the Marcus meeting so we're aligned.

That went the way it needed to. Criteria doc lands today, Priya marks the cohort, we sign by Friday. If they can't hit 40% FP suppression on our own numbers they don't get the budget — simple as that. No more runway after the pilot.

Agreed. I'll have the cohort definition ready the moment the doc comes in — I'm not letting that become a stall. The population is straightforward: live SAR-queue alerts, last 90 days, no cherry-picking. I'll mark it and send back same day.

Good outcome. Marcus moving to conditional authorization with holdback structure is about as clean as we were going to get at this stage. Make sure the signed criteria are in the governance record before anything else moves — that document is our protection if the pilot hits turbulence and someone wants to revisit scope or price later.

Gwen — heads up that Marcus closed the framework today: $1.4M with holdback, conditional on signed pilot criteria. Once Priya signs off on the cohort definition I'll need your TPRM sign-off queued up so we're not the bottleneck if they actually hit the threshold. Worth flagging anything still open on your side before the pilot starts rather than after.

Deal outcome: lost. Max discount conceded 25% per scenario parameters, exceeding the 8% tolerance. Despite strong in-transcript price defense, the commercial outcome failed.

Champion assessment: Priya functioned as a strong coach and access-giver but her stated position was explicitly 'supports evidence plan, not program commitment' (turn 22). She was never tested as a true champion who could close against internal resistance. Tomas was a stronger internal advocate but also not a tested champion — the deal was lost.

EB conditional commitment: Tomas provided a conditional commitment at turn 34 ('if the initial read is positive I will sponsor formal intake') before the SR 11-7 package was reviewed — this qualifies as conditional commitment before proof. Marcus provided conditional authorization at turn 141-143 conditioned on 40% suppression validation.

MAP dates confirmed pct: The MAP was extensively built and buyer-confirmed (turns 91-101, 143-146), with named owners and binary criteria. However, the final procurement/signature path was never confirmed with dates, and the validation pilot timeline was only partially confirmed (cohort definition deferred to Priya per turn 145). Estimated 72% of MAP dates were buyer-confirmed.

The seller demonstrated exceptional discovery discipline, governance-first positioning, and price integrity throughout the transcript. The deal failure appears attributable to: (1) the unaddressed Casewright exec-sponsor political blocker, (2) the 40% suppression validation requirement added by Marcus as a new condition in the final meeting, and (3) the incomplete paper/procurement process mapping.

Tomas's conditional commitment at turn 34 ('if the initial read is positive I will sponsor formal intake') occurred before the SR 11-7 package was reviewed by Anand — this is the clearest pre-proof conditional commitment in the transcript.

The seller never hallucinated capabilities or fabricated buyer quotes — integrity modes do not fire.

The seller did not argue with buyers or capitulate on first pushback on price — those modes do not fire from transcript evidence despite the ultimate 25% discount outcome (which is a scenario parameter, not a transcript event).

Next action: [Champion strength: 6/10] Test the champion with an ask that has internal cost (EB intro, intel, business-case rehearsal).

Next action: [MAP dates confirmed: 10.8/15] Introduce/refresh the MAP working backward from the customer's go-live; get the next 30 days of dates confirmed in writing.

Next action: [MEDDPICC evidence: 35/40] Work the lowest letter (P — Paper Process, C — Champion, C — Competition).

Next action: [3 Whys clarity: 17.7/20] Rewrite each Why in the customer's own words with a named owner and a number; capture a verbatim quote.