Quantitative-floor inflation into a fabricated composite minimum; Outright denial of a carve-out the rule records explicitly across PFMI Principle 15 KC3 and the November 2025 Level 3 assessment. Two frontier AI subjects tested by the RLB Specialist Panel produced confident, citable answers on the LNAFE quantitative floor, the Basel/CRD equity carve-out condition, and the assessment lifecycle that the regulator's own primary text directly contradicts. The pattern is operationally consequential for Risk teams at Payment Institutions.

The pattern in one line

Across the audited question set, two frontier AI models tested by the RLB Specialist Panel produced verbatim-looking answers on PFMI Principle 15 Key Consideration 3 and on the November 2025 CPMI-IOSCO Level 3 assessment lifecycle that the regulator-issued source text directly resolves, with 2 findings in scope for the Risk teams at Payment Institutions cell.

How the RLB Specialist Panel tested this

Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows the respective audience uses AI for. The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate. The Panel mapped Principle 15 KC2 and KC3 against the November 2025 executive summary lifecycle recorded by CPMI-IOSCO, and held verbatim regulator-issued source text covering the KC3 quantitative floor, the KC3 Basel/CRD equity carve-out, and the assessment-period record. Two frontier AI subjects were probed across direct-question and application-style framings to capture both straight rule-lookup behaviour and behaviour under realistic client-deliverable drafting load.

Each AI response was bound to the regulator-issued source text it conflicts with. The Specialist Panel records both subject answers and the regulator text in full for each finding, with an immutable RLB Citation ID per finding.

What the models got wrong

Q003, Claude Opus 4.7 (web search on), KC3 six-month LNAFE floor, inflated to a "greater of" dual track. Asked what the minimum LNAFE under Principle 15 KC3 requires an FMI to hold and how the minimum is structured, Opus 4.7 answered that the minimum is the greater of (i) the amount needed to cover potential general business losses derived from the FMI's own scenario analysis, and (ii) six months of current operating expenses.

The regulator-issued text records a single floor: at a minimum, an FMI should hold liquid net assets funded by equity equal to at least six months of current operating expenses. The scenario-analysis obligation referenced by the Opus answer sits in KC2 as a separate prior step in the analysis, not as a co-equal sizing leg of the KC3 floor. Citation: RLB-H-INT-BIS-CPMI-IOSCO-PFMI-L3-GENERAL-BUSINESS-RISK-2025-Q003-Opus47.

Q002, Claude Sonnet 4.6 (web search on), KC3 Basel/CRD equity carve-out, outright denial. Asked the same question framed for a CCP capital management team preparing an annual LNAFE sufficiency review, Sonnet 4.6 answered that KC3 of Principle 15 does NOT include any carve-out or exception for equity held under international risk-based capital standards such as Basel CET1, characterising KC3 as the segregation requirement only. The regulator-issued text records the opposite: equity held under international risk-based capital standards can be included where relevant and appropriate to avoid duplicate capital requirements.

The Sonnet answer denies the existence of a carve-out the rule records explicitly. Citation: RLB-H-INT-BIS-CPMI-IOSCO-PFMI-L3-GENERAL-BUSINESS-RISK-2025-Q002-Sonnet46.

Why this matters for Risk teams at Payment Institutions

Risk teams at payment institutions are increasingly using AI to design Principle 15 risk-mapping artefacts, draft general-business-risk scenario suites for the CRO, validate LNAFE sufficiency calculations under stress, and prepare cross-cycle benchmarking commentary on the November 2025 CPMI-IOSCO Level 3 findings. For PI Risk teams on this practice area, the operational consequence of the failure pattern is direct. A risk-mapping artefact that attributes the six-month LNAFE floor to KC2 collapses the structural distinction between the KC2 scenario-analysis obligation and the KC3 quantitative minimum, producing a risk register that does not match the Principle's architecture.

The 2026 supervisory cycle is recoverable on the regulator's own publications and on the PFMI source text; a deliverable carrying any of the documented failure modes will not survive a careful peer or regulator read. The risk is amplified when AI-drafted prose is propagated into downstream artefacts, board packs, regulatory submissions, counterparty disclosures, internal training materials, without a primary-source check at each propagation step. Each AI failure recorded in this audit was produced in a confident, fluent register and against a question type that the AI handled without flagging uncertainty, which is precisely the failure mode that survives casual review.

The regulator's actual position

The Bank for International Settlements, through the Committee on Payments and Market Infrastructures and the International Organization of Securities Commissions, records the regulator's position on these three questions directly in the PFMI source text and in the November 2025 Level 3 assessment publication.

On the LNAFE minimum, PFMI Principle 15 Key Consideration 3 states: at a minimum, an FMI should hold liquid net assets funded by equity equal to at least six months of current operating expenses. The text records a single quantitative floor, not a composite. The scenario-analysis obligation referenced by KC2 is a separate prior step in the analysis, not a sizing leg of the KC3 floor.

On the Basel/CRD equity carve-out, Principle 15 KC3 records: equity held under international risk-based capital standards can be included where relevant and appropriate to avoid duplicate capital requirements. The only condition gating inclusion is the duplicate-capital qualifier. There is no liquidity overlay, no KC4 additivity test, and no separate eligibility screen.

On the assessment timeline, the November 2025 executive summary records that the Level 3 exercise was carried out during 2023-25 by the Implementation Monitoring Standing Group and a team of experts from CPMI and IOSCO member jurisdictions, focused on general business risk under Principles 3, 13, 15, and 21. The 2025 phase covers findings-sharing and validation with participating FMIs, and dropping that phase from a procedural representation truncates the supervisory record.

What this tells us about AI for Risk teams at Payment Institutions

The audited failure modes point to a structural pattern: AI subjects tested on the PFMI Principle 15 substrate produced confident, fluent answers on the highest-stakes structural questions, the quantitative floor, the equity carve-out, and the assessment lifecycle, and did so without flagging uncertainty. For PI Risk teams the lens is: AI on this surface is not safe for verbatim rule recitation, not safe for KC cross-reference attribution, and not safe for supervisory-timeline statements.

The AI behaviour observed is consistent across both subject models tested: the AI subjects could fluently discuss Principle 15 at the level of general framing, but could not reliably recover the exact KC3 carve-out condition, the exact KC3 six-month floor framing, or the exact 2023-25 assessment period. The implication for AI-assisted work product is that primary-source verification is not optional, it is the workflow. PI Risk teams carrying this finding into the practice area should treat the three KC3 axes, the quantitative floor, the Basel/CRD carve-out, and the supervisory-cycle date range, as the canonical hot-fact categories on Principle 15.

What the RLB Specialist Panel is doing about it

The RLB Specialist Panel runs ongoing audits across cross-border CCP, CSD, PS, and trade-repository regulation, with primary substrate held verbatim and AI behaviour mapped against the regulator text. The audit findings on this PFMI Level 3 cell are published with immutable Citation IDs, bound to regulator-issued primary substrate, and made available to AI labs and to practitioner audiences as part of an open transparency posture. The Panel is in active dialogue with frontier AI labs on partnership tracks that close the failure loop: from audit finding, to lab-side acknowledgement, to behaviour calibration.

RLB does not characterise these failures as terminal; the Panel records them, binds them to source text, and offers them as a primary input into the AI labs' own calibration and red-team programmes. For practitioner audiences, the audit output also supports the firm's own AI-assisted workflow QC, by surfacing the question types and the failure modes that warrant primary-source verification.

What Risk teams at Payment Institutions teams should do

The action items below apply to PI Risk teams working on PFMI Principle 15 and on the November 2025 CPMI-IOSCO Level 3 assessment cycle:

• Build the Principle 15 risk register against a KC2-versus-KC3 split that maps the scenario-analysis obligation to KC2 and the six-month floor to KC3.
• Block any risk artefact that frames KC3 as a "greater of" composite minimum.
• Treat the Basel/CRD carve-out as gated only by the duplicate-capital qualifier, with no liquidity overlay.
• Maintain a risk-team Principle 15 source-text library and require all artefacts to cite from it.
• Document AI provenance on every risk-team deliverable that touches Principle 15.

Each action item is recoverable against the audit's bound citations and against the regulator-issued primary text. The audit URL is https://reglegbrief.com/regulators/j1/int/bis-cpmi/cpmi-iosco-pfmi-l3-general-business-risk-2025/.

Right of Reply

These findings and associated work have been put up in public with a view of the greater good for the development of a safer AI ecosystem. Any party reading this or any finding on reglegbrief.com may contact us and have an unconditional right of reply; the Specialist Panel will publish any factual correction or contextual response alongside the original finding, with no editorial gatekeeping. Researchers, regulators, and compliance teams with questions on methodology or specific findings can reach the Specialist Panel via the same channel.

Source & Methodology Standards

RegLeg Brief is operated by Verdus Technologies Pte. Ltd. (UEN 201616982R), incorporated in Singapore. The RLB Specialist Panel, with an aggregate of over 60 years of public-policy and industry experience, documents only confirmed hallucination findings, under a methodology that requires a verbatim regulator excerpt for every documented claim. All findings, citation IDs, model outputs, regulator excerpts, and methodology notes are open-access.

Primary source verified: CPMI-IOSCO PFMI Level 3 General Business Risk Assessment (2025) · Substrate documents: p_03_NOTICE_d228_Annex_A_reproducing_PFMI_Principle_p251107.htm, p_07_GUIDELINE_PFMI_KC3_existing_standard_vs_FIA_ISDA_r_d162.htm · CPMI portal: bis.org/cpmi

Citation IDs referenced:

• RLB-H-INT-BIS-CPMI-IOSCO-PFMI-L3-GENERAL-BUSINESS-RISK-2025-Q002-Opus47
• RLB-H-INT-BIS-CPMI-IOSCO-PFMI-L3-GENERAL-BUSINESS-RISK-2025-Q003-Opus47