Verification log

CRA Reporting-Ready Pack current to 2026-08-20 · edition 1.2

Pack page · changelog

Datasets behind the free guides

• Item texts verbatim from Reg (EU) 2024/2847 Annex III/IV, read from EUR-Lex CELEX 32024R2847 HTML 2026-08-26 (archived in scratch + Y02 FACTS.md §Scope); plain-language readings and product examples are our own and expressly non-binding — binding technical descriptions live in Implementing Reg (EU) 2025/2392. Conformity-route facts: Y02 FACTS.md Art 32 [VERIFIED], harmonised-standards status [VERIFY-ON-CHANGE ~30 Oct 2026].
• Y02 kit FACTS.md — claims verified vs the Publications Office copy of CELEX 32024R2847 (adversarial audit 2026-07-15; refreshes 2026-08-12 and 2026-08-20 vs live ENISA/Commission pages). ENISA Single Reporting Platform mechanics summarized from the ENISA AR guides (Jul–Aug 2026), which ENISA marks 'subject to change'. Annex III/IV item texts verified verbatim vs EUR-Lex 2026-08-26.

From the pack's verification file

Y02 FACT PACK — CRA (Reg (EU) 2024/2847) primary sources (verified 2026-07-15 by research agent)

• SHIP DISCIPLINE ⚖: original draft came from a mirror; an adversarial audit on 2026-07-15 verified the load-bearing claims against the primary Publications Office copy of CELEX 32024R2847 — CONFIRMED: Art 69(3) legacy-scope (corrected from 69(2)), both Art-14 clocks, definitions (3(42)/14(5)), recipients/cascade (14(1)/(7)), penalties (64), support period (13(8)/(9)/(19)), annex numbers (I–VIII), Annex I Part II vuln-handling points. STILL [UNVERIFIED] (leave hedged): Annex I Part I internal point-numbering (1)/(2)(a-m), the Class I/II/critical category *lists*, and the "automatic updates opt-out" exact wording. CRA OJ facts CONFIRMED: published OJ L 2024/2847 on 20 Nov 2024, in force 10 Dec 2024 (Art 71). Not legal advice / never conformity assessment — on every kit file.

REFRESH 2026-08-20 (viability-recheck sweep; detail in ../../reviews/2026-08-20-viability-recheck.md)

• Sep-11 confirmed, no postponement (ENISA SRP page fetched 20 Aug); SRP still not live, URL unpublished; webinar (~2 wks pre-launch ⇒ ~28 Aug) not yet announced; voluntary reporting only enabled after go-live.
• ENISA AR-interface guide revised 14 Aug 2026 → kit/02 §D.3 (unverified-AR 10-notification cap; drafts private per representative; pending-invitation records; secondary-promotion via CSIRT; red alerts incl. CSIRT-invalidated submissions; multi-manufacturer associations). [Summarized from revision notes; re-verify vs the PDF — tracker item.]
• Harmonised standards slip: M/606 first-OJ-citation timeline now ~30 Oct 2026 (unrelated to Art 14; keeps "Class I has no self-assessment path" true longer).
• Free-artifact kill-check NOT triggered: BAUER library still "not finalised" + CC BY-NC (commercial use prohibited); ENISA ships guidance not templates (plus a free SME maturity Excel, 13 Jul — diagnostic only).
• Demand rising: law-firm alert cluster (Jones Day Jul; Crowell Jun; teiss 11 Aug; German trade press mid-Aug); ENISA SME survey (24 Jun, n=194): high awareness, low readiness, ~35% SBOM use.

Art 14 reporting — TWO tracks, manufacturers only

• RECIPIENTS: simultaneously to (i) CSIRT designated coordinator of the Member State of manufacturer's MAIN ESTABLISHMENT and (ii) ENISA, via the Art 16 Single Reporting Platform. Main establishment = where product cybersecurity decisions predominantly taken; non-EU cascade: authorised rep -> importer -> distributor -> highest user concentration (Art 14(7)).
• LEGACY SCOPE — THE FLAGSHIP FACT (Art 69(3), VERIFIED verbatim vs CELEX 32024R2847; CORRECTED from 69(2) after audit 2026-07-15): "By way of derogation from paragraph 2 of this Article, the obligations laid down in Article 14 shall apply to all products with digital elements that fall within the scope of this Regulation that have been placed on the market before 11 December 2027." => from 2026-09-11 reporting covers the WHOLE in-scope installed base. Commission confirms 2026-09-11 start. (NB: Art 69(2) is the UNRELATED rule — pre-2027 products face the full requirements only on substantial modification; never cite 69(2) for the reporting-scope headline.)

Single Reporting Platform (SRP) status — [VERIFY-ON-CHANGE, tracker item #1]

• NOT live as of early July 2026. Commission (page upd 2026-06-08): ENISA procured a contractor, testing period, "operational by 11 September 2026." Still not live 2026-06-29 (cyberresilienceact.eu). ENISA manuals/FAQ promised "in June 2026", pending. NO official interim channel published (duty starts 09-11 so no pre-launch route given). Pack analysis (NOT sourced instruction): duty to notify CSIRT+ENISA stands independent of platform; direct channels = fallback if SRP slips [UNVERIFIED].

Scope

• SaaS nuance: pure SaaS/cloud stays under NIS2; a cloud back-end counts as part of the product only when the product functionally DEPENDS on it and it's developed by/for the manufacturer (Art 3(2) "remote data processing"). The 2026-03-03 draft guidance addresses this boundary.
• Classes: important Class I/II = Annex III; critical = Annex IV. Binding technical descriptions: Implementing Reg (EU) 2025/2392 (adopted 2025-11-28) — classification worksheet keys off it. Category lists [VERIFIED 2026-08-26 verbatim vs EUR-Lex CELEX 32024R2847 HTML]: Annex III Class I = 19 items (identity mgmt/PAM; browsers; password managers; anti-malware; VPN products; network mgmt; SIEM; boot managers; PKI/cert issuance; network interfaces; operating systems; routers/modems/switches; security microprocessors; security microcontrollers; ASIC/FPGA w/ security functionality; smart-home virtual assistants; smart-home security products incl. smart locks/cameras/baby monitors/alarms; connected toys (2009/48/EC) w/ social-interactive or location features; health-monitoring wearables outside MDR/IVDR + children's wearables). Class II = 4 (hypervisors/container runtimes; firewalls+IDS/IPS; tamper-resistant microprocessors; tamper-resistant microcontrollers). Annex IV critical = 3 (hardware devices w/ security boxes; smart meter gateways (2019/944 Art 2(23)) + advanced-security/secure-cryptoprocessing devices; smartcards/secure elements). Verbatim item text archived in venture-lab/content/cra/categories.json.

Dec-2027 obligation set (roadmap section)

• Annex numbering [CONFIRMED vs CELEX 32024R2847, audit 2026-07-15]: essential requirements = Annex I (Part I product / Part II vuln-handling); user info/instructions = Annex II; important products (Class I/II) = Annex III; critical products = Annex IV; EU DoC contents = Annex V; simplified EU DoC = Annex VI; technical documentation = Annex VII; conformity-assessment modules = Annex VIII. (Stop hedging — these are authoritative.)

Annex I Part II vulnerability handling (VERIFIED — template basis)

Penalties (Art 64 VERIFIED)

• Enforcement: national market-surveillance authorities (Reg 2019/1020). CAB milestone 2026-12-11; full application 2027-12-11.
• OPEN QUESTION to flag (do NOT assert): Art 64 not in early-application list => whether fines attach to Art 14 breaches BEFORE 2027-12-11 is contested/state-dependent [UNVERIFIED] — present as open, point to national implementing laws.

Artifact status TODAY — pack value intact [VERIFY-ON-CHANGE items = tracker]

• Commission guidance: DRAFT only (first draft 2026-03-03; remote data processing, FOSS, support periods, interplay). No final as of 2026-07-15.
• Adopted: Impl Reg 2025/2392 (tech descriptions, 2025-11-28); delegated act on CSIRT dissemination-delay (2025-12-11, cited Reg (EU) 2026/881, awaiting OJ).
• NOT adopted / no draft: Art 14(10) notification-format act; Art 13(24) SBOM-format act; Art 33(5) simplified SME technical-documentation FORM (the main obsolescence risk — if an official SME form or ENISA templates ship, reposition). ENISA has FAQs/manuals pending, NOT templates.
• Standards: first CEN/CENELEC/ETSI deliverables targeted Q3 2026, rest by 2027-10-30; NO harmonised standard cited in OJ yet (first citation flips Class I self-assessment on).

Competition (ToC differentiation)

Tracker (VERIFY-ON-CHANGE) subscription content

• SRP go-live; ENISA manual/FAQ; Delegated Reg 2026/881 OJ publication; final Commission guidance; first harmonised-standard OJ citation (flips Class I self-assessment); Art 33(5) SME tech-doc form; Art 14(10) notification-format act; Art 13(24) SBOM-format act; Q4-2026 EUCC delegated act; national penalty-regime laws (esp. pre-2027 Art 14 fine applicability).

REFRESH 2026-08-12 (agent-verified vs live ENISA/EC pages)

• ENISA SRP docs NOW PUBLISHED: Factsheet v1.0 (Jul 2026), AR User Registration guide (upd 03/08), AR Notification Submission & Update guide (upd 31/07), expanded FAQ. Helpdesk cra-srp-helpdesk@enisa.europa.eu. All marked "subject to change" → tracker cadence is the product.
• Art 16(2) restricted dissemination (single-MS / essential-security / imminent-risk flags → ENISA gets partial info until CSIRT releases); delayed-dissemination DELEGATED REGULATION adopted Dec 2025 (OJ number 2026/881 UNCONFIRMED this sweep — cite as "the Dec-2025 delegated regulation on delayed dissemination").
• STATUS: SRP still pre-launch; operational by 2026-09-11; public URL not yet posted; ENISA webinar ~2 weeks pre-launch (~late Aug); how-to videos pending. Voluntary reporting only AFTER Sep 11. Do-today: EU Logins ×2 + pre-stage entity/product data.
• NEW OFFICIAL ARTIFACT: Commission CRA APPLICATION GUIDANCE published 2026-07-27 → crosswalk in kit. Still outstanding: Art 33(5) SME form; first harmonised standard in OJ.
• COMPETITOR (NIS2-Templates €349, v1.1, 18 deliverables): own page flags SRP details "[TO BE CONFIRMED]" — predates the ENISA guides. BAUER free library: banner-marked "not finalised", CC BY-NC (non-commercial license friction). OUR WEDGE: registration runbook current to 31 Jul/3 Aug + field matrix + Art 16(2)/delegated-act handling + 27-Jul guidance crosswalk + go-live tracker + commercial license.

Editions

• v1.2 · 2026-08-21 — Single-organisation licence added to the pack (LICENCE.md); every delivered copy is now individually watermarked to the buyer.
• v1.2 · 2026-08-20 — ENISA representative-interface mechanics added from the 14 Aug guide; reporting-platform status re-verified (still not live); harmonised-standards timeline slip to ~30 Oct noted.
• v1.1 · 2026-08-12 — Single Reporting Platform registration runbook and the published field matrix added; Commission 27 Jul application guidance crosswalked; status re-baselined.
• v1.0 · 2026-07-15 — First edition. Art 69(3) legacy-product scope verified verbatim against CELEX 32024R2847 — products already on the market are in scope of the Art 14 duty.

AI Act Article 50 Kit current to 2026-08-20 · edition 1.2

Pack page · changelog

Datasets behind the free guides

• V1 kit FACTS.md — Reg (EU) 2024/1689 Art 50 + Art 99 (fetched), Omnibus Reg (EU) 2026/1744 (OJ 24 Jul 2026, in force 27 Jul 2026), Commission final Art 50 Guidelines adopted 20 Jul 2026 (deltas agent-verified vs live Commission pages 2026-08-12), CoP adequacy 8–9 Jul 2026, official EU icons page (upd 10 Aug 2026). Marking-tech status carries the announced-vs-live discipline (verified 2026-08-20).

From the pack's verification file

V1 FACT PACK — Article 50 primary sources (verified 2026-07-15 by research agent; citation tiers: F=fetched, S=search-confirmed)

REFRESH 2026-08-20 (viability-recheck sweep; detail in ../../reviews/2026-08-20-viability-recheck.md)

• Marking-tech update (supersedes the "mid-2026" section below): Anthropic ANNOUNCED (11 Aug; explainer ~14 Aug: anthropic.com/news/claude-text-watermark) model-level text watermarking + C2PA on file outputs per its CoP commitment — NOT LIVE as of 2026-08-20: "*future* Claude models will generate text that contains a watermark"; pre-Aug-2 models "over the coming months"; detection API "soon". [CORRECTED 2026-08-20 after founder review — an earlier same-day version of this block called it live. Treat Claude output as UNMARKED until a go-live is verified.] Suno/Substack announced marking; majors committed via CoP. LIVE baseline remains OpenAI C2PA+SynthID images + Google SynthID (May 2026, verified). First C2PA-conformant text-marking tools certified since Jun 2026. ⇒ Edition 1.2 tilt unchanged and *sharpened*: announcements ≠ marks — differentiation = verify-what-ships + survival testing + evidence.

Duties (statute: Reg (EU) 2024/1689 Art 50; F: artificialintelligenceact.eu/article/50/)

Dates

• Art 50 applies 2026-08-02, and this date is set by Art 113 of the BASE Regulation 2024/1689 (AI Act in force since 2024-08-01) — it is INDEPENDENT of the Digital Omnibus and holds regardless of the Omnibus's status. High-risk delays (Annex III → 2027-12-02, Annex I → 2028-08-02) are the Omnibus's doing, not Art 50's.
• The 50(2) marking transition (systems placed BEFORE 2026-08-02 get until 2026-12-02; on/after Aug 2 → immediate; 50(1)/(3)/(4) NO grace) is Omnibus-created. OMNIBUS STATUS as of 2026-07-15 (confirmed by audit): adopted (Parliament 16 Jun, Council 29 Jun 2026) but NOT yet published in the OJ, so NOT in force today; OJ publication expected ~18–25 Jul, in force 3 days after (late Jul 2026, before Aug 2). => Present the 2 Dec marking grace as "adopted 29 Jun 2026, pending OJ publication / expected in force late Jul 2026," NOT as current in-force law. [VERIFY-ON-CHANGE: Omnibus OJ publication → tracker; then the grace is in force.]

Code of Practice on Transparency of AI-Generated Content (published 2026-06-10)

• Signatory: form emailed to CNECT-AIOFFICE-CODE-OF-PRACTICE-TRANSPARENCY@ec.europa.eu, senior-exec signature; FIRST-WAVE LIST DEADLINE 2026-07-22 18:00 CET; late accession possible.
• Benefit: "streamlined way to ensure and demonstrate compliance"; TechPolicy: once endorsed by Commission+AI Board, signatories "may rely on adherence" — adequacy assessment PENDING. [VERIFY-ON-FINAL.]

Guidelines: DRAFT (published 2026-05-08; consultation closed 2026-06-03; final expected pre-Aug-2; not adopted as of 2026-07-15)

Marking tech (mid-2026)

• OpenAI (2026-05-19): C2PA-conformant + Google SynthID on ALL images (ChatGPT/API/Codex); verification tool previewed.

Penalties (F: Art 99)

• Enforced by national market-surveillance authorities; penalties chapter live since 2025-08-02; no Art-50-specific penalty grace beyond the 50(2) transition.

Extraterritoriality (Art 2(1)(a),(c))

Competition gaps (for ToC differentiation)

VERIFY-ON-FINAL master list

REFRESH 2026-08-12 (agent-verified vs live Commission pages) — the VERIFY-ON-FINAL regime is RESOLVED

• FINAL GUIDELINES adopted 2026-07-20 (51pp, 24 EU languages, non-binding). Deltas vs draft:
• (d) FANTASTICAL CONTENT: final guidelines EXCLUDE "wholly fantastical content, or content no audience would take as genuine" from deepfake scope — but "could plausibly exist" reads broadly; creative/satirical carve-out "interpreted strictly"; informative character "always prevails"; advertising is "evidently creative" only in specific situations (Commission's ad examples all require standard labeling).
• (g) Other: B2B carve-out = 3 CUMULATIVE conditions (not shared externally + controlled environment + misuse safeguards); disclosure must REPEAT where viewers may join mid-content; NO retroactive labeling of pre-2026-08-02 content; incidental/unforeseeable downstream EU use alone ≠ in scope.
• CoP ADEQUACY: Commission 2026-07-08 + AI Board 2026-07-09. Effect (official wording): signatories "can rely on its measures to demonstrate compliance" for 50(2)/(4)/(5). Not conclusive proof; ~190 signatories by end-July; LATE ACCESSION OPEN (form live, no deadline). No Art 50(7) implementing act.
• OMNIBUS = Reg (EU) 2026/1744: OJ 2026-07-24, IN FORCE 2026-07-27. Transition scope CONFIRMED: 50(2) machine-readable marking ONLY, for generative systems placed on market BEFORE 2026-08-02 → comply from 2026-12-02. New systems: no runway. No other Art-50 change. [Open: pinpoint amending-article # inside 2026/1744 — EUR-Lex render failed; pull CELEX 32026R1744 for the citation footnote.]
• OFFICIAL EU ICONS (page upd 2026-08-10): 3 icons (basic/fully-AI/partially-AI-modified) × 4 variants, SVG+PNG ZIPs, free, no attribution. VOLUNTARY — "the labelling requirements under Article 50 are not." Commission's own research: icon+TEXT label performs best. Icons serve 50(4) visible labeling; they do NOTHING for 50(2) machine-readable marking (separate duty).
• ENFORCEMENT: zero public Art-50 actions as of 2026-08-12 (10 days in — expected). Frame: "powers live since Aug 2, fines defined (€15M/3%), no public actions yet."
• [Open #2: a "2027-02-02 watermark-detection interoperability" date circulating in law-firm notes — likely a CoP commitment timeline, NOT the Omnibus; verify against CoP text before attributing to a legal instrument.]

Editions

• v1.2 · 2026-08-21 — Single-organisation licence added to the pack (LICENCE.md); every delivered copy is now individually watermarked to the buyer.
• v1.2 · 2026-08-20 — Correction, same day: the 11 Aug Anthropic text-watermarking news was briefly described as live and was corrected within hours to ANNOUNCED-only, against Anthropic's own explainer ("future Claude models will generate text that contains a watermark"). Anthropic go-live is now an explicit watch item. This is the kit's own rule applied to itself: verify what upstream actually emits before relying on it.
• v1.2 · 2026-08-20 — Verification-and-evidence reframe in chapter 03; the model-layer marking announcement wave folded in; enforcement watch re-verified (no public Art 50 actions yet).
• v1.1 · 2026-08-12 — Re-baselined to the FINAL Article 50 Guidelines adopted 20 Jul 2026; all prior draft hedges resolved; value chain settled — the application-layer provider marks.
• v1.0 · 2026-07-15 — First edition.

EU Green Claims Compliance Kit current to 2026-08-21 · edition 1.0

Pack page · changelog

Datasets behind the free guides

• G1 kit file 01 §§1,4 — verbatim point text from Directive (EU) 2024/825 (EU legal text); plain-language readings are our own
• G1 kit file 01 §§2–3 (recital 9 phrase list, recital 10 calibration, Art 2(p)/(s)); rewrites are our own illustrative patterns
• G1 kit file 01 §7 transposition table, verified 2026-08-21

From the pack's verification file

G1 FACT PACK — EmpCo (Directive (EU) 2024/825) primary sources (verified 2026-08-21)

• Verification: official OJ text via the Publications Office cellar (not mirrors) — CELEX 32024L0825 (ELI data.europa.eu/eli/dir/2024/825/oj) + consolidated UCPD 02005L0029-20220528 + Implementing Reg CELEX 32025R1960. ~45 lookups, 2026-08-21, research agent. Every kit file is stamped "current to 21 August 2026".
• SHIP DISCIPLINE ⚖: Pinpoints verified verbatim against the cellar copy of CELEX 32024L0825: Art 4(1) both dates; the full new Annex I point set 2a · 4a · 4b · 4c · 10a · 23d · 23e · 23f · 23g · 23h · 23i · 23j (audit note: the run ends at 23j — there is no 23k; count the identifiers: twelve — an earlier summary's "eleven total" label was a fencepost miscount of the 23d–23j run, which is SEVEN points; buyer-facing files count the list: 5 environmental + 7 durability/software = 12); amended Art 6(1)(b), 6(2)(d) verbatim, 6(2)(e), 7(7); new Art 2 definitions (o)–(s). EMAS correction (audit): EMAS is NOT an Art 2(s) qualifier — it appears in recital 8 body text, which names EMAS logos as an example of sustainability labels *established by public authorities* — so EMAS can satisfy point 2a, but it is still NOT an Art 2(s) carve-out route for point 4a; the carve-out list is exactly EU Ecolabel (Reg 66/2010) | officially recognised national/regional EN ISO 14024 type-I schemes (e.g. Blauer Engel, Nordic Swan) | top performance under other Union law (e.g. energy class A under Reg 2017/1369). Never list EMAS as a pathway. Tense discipline: GCD = stalled proposal, NOT law, NOT formally withdrawn; FR transposition bill pending [UNVERIFIED final adoption]; CPC Common Understanding = non-binding. Rails on every kit file: not legal advice ×2 (header + in context); no clearance opinions; never "trader X's claim is illegal" — always "this pattern fails point X as written"; [ILLUSTRATIVE — not legal clearance; substantiation still required] on every rewrite entry; 27-state transposition-variance caveat everywhere; the Reg 2025/1960 notice/label are PRESCRIBED formats — explain use, never redesign.

The instrument

• Directive (EU) 2024/825 ("Empowering Consumers for the Green Transition", EmpCo), OJ 6 Mar 2024. Amends UCPD 2005/29/EC and CRD 2011/83/EU.
• Art 4(1) verbatim: "By 27 March 2026, Member States shall adopt and publish the measures… They shall apply those measures from 27 September 2026." Application does NOT slide with late transposition — the apply-from date is fixed in the directive.

New UCPD Annex I points — the blacklist additions (VERIFIED verbatim; 12 identifiers, range ends at 23j)

Amended UCPD Arts 6/7 (VERIFIED)

New UCPD Art 2 definitions (VERIFIED)

Recital anchors (interpretation aids, cite as recitals)

CRD 2011/83/EU changes (product pages + POS duties)

• New Art 22a → Implementing Reg (EU) 2025/1960 (25 Sep 2025, CELEX 32025R1960) prescribes the harmonised notice + label designs. These are PRESCRIBED formats: the kit explains how to obtain and use them; it never redesigns or imitates them (file 06).

Transposition scoreboard — stamped as of 2026-08-21 [VERIFY-ON-CHANGE, tracker item #1, weekly]

• Commission sent letters of formal notice to 20 states, 28 May 2026 (infringement step 1).
• Detail: DE fully transposed (UWG amendment BGBl 19 Feb 2026 + CRD act 5 Feb 2026; both in force 27 Sep 2026) · IT D.Lgs 30/2026 · NL bill passed lower house 23 Apr 2026, Senate pending · ES consultation closed, no act · PL nothing found.

Non-transposed-state frame (USE EXACTLY THIS LEGAL LOGIC — kit 00/01/07)

Penalties (attribution discipline: the 4% figure is NOT EmpCo's)

• UCPD Art 13(3) as amended by Directive (EU) 2019/2161: for CPC widespread infringements, fines with a maximum of "at least 4 % of the trader's annual turnover in the Member State or Member States concerned" (⚠️ never truncate the limiting phrase — it scopes exposure to affected-state turnover). Art 13(4): "at least EUR 2 million" where turnover information is unavailable. States may go higher.
• France reportedly up to ~10% of average annual turnover for environmental claims [UNVERIFIED at primary source — cite as reported, Dentons 5 May 2026] → Q2.

Enforcement posture — old stock

• CPC Network "Common Understanding" on old stock, 30 Jun 2026 (NON-BINDING): compliance-first, phased approach; ONLINE claims prioritized over printed packaging; guidance/corrective action favored over recall-destruction for good-faith transition. → dedicated sell-through one-pager, kit file 07 (top buyer FAQ).

Real enforcement cases (all under PRE-EmpCo law — that is the urgency point)

• | KLM "Fly Responsibly"/SAF ads | Amsterdam District Court, 20 Mar 2024 | ads held misleading |
• | KLM Denmark | Danish Consumer Ombudsman, ~10 Jul 2026 | DKK 3M (~€401,000) fine over "a big step forward towards slightly more sustainable travel" at ~1% SAF |
• | Zalando | Feb 2024 | removed sustainability flags/icons after Commission+CPC action |
• | Katjes "klimaneutral" | BGH 27 Jun 2024, I ZR 98/23 | ambiguous eco-terms must be explained in the ad itself; offsetting ≠ reduction — claim unlawful |
• | Apple Watch "carbon neutral" | Frankfurt court, date ⏳ Q8 — audit C flagged the Aug-2024 stamp as uncited and possibly Aug 2025 (LG Frankfurt, DUH v Apple); de-specified in all buyer files 2026-08-21 pending primary verification | claim barred in DE |
• | 20 airlines | CPC sweep, 30 Apr 2024 | coordinated action on green claims |

EmpCo vs GCD — tense discipline (kit 01 carries this near-verbatim)

• EmpCo (2024/825) is law; the Green Claims Directive (proposal 2023/0085) is a stalled companion that would have added ex-ante substantiation-and-verification machinery. OEIL status: "Awaiting Council's 1st reading position"; Commission announced intent to withdraw Jun 2025, never formally did; Council Presidency abandoned negotiations (reported 11 Jun 2026). The operative 2026 regime = EmpCo + existing UCPD, via national law. Never describe the GCD as in force; never describe it as withdrawn.

Free artifacts (all guidance, no templates — our shelf space)

• Commission FAQ on 2024/825 — first Nov 2025, updated 18 May 2026; explicitly NON-BINDING.

Competitors (shelf check 2026-08-21, human-browser)

Keyword economics [ESTIMATE ±2x — no Keyword Planner run]

Rewrite-library seeds (13 → kit file 02, each [ILLUSTRATIVE] + substantiation banner)

Verification queue (mirrored in kit file 08 tracker)

• | # | Item | Status @ 2026-08-21 | Route |
• | Q2 | FR ~10% avg-turnover penalty for environmental claims | [UNVERIFIED at primary source] — cite as reported (Dentons 5 May 2026) | Code de la consommation check |
• | Q4 | Residual marketplace shelf risk | Etsy ×2 + Gumroad clean 2026-08-21; Google/Bing unverifiable | re-run shelf check at launch + monthly |
• | Q6 | Transposition scoreboard refresh | 18/27 communicated as of 2026-08-21 | weekly via tracker (file 08) |

Sources

• OJ text: http://publications.europa.eu/resource/celex/32024L0825 (ELI: data.europa.eu/eli/dir/2024/825/oj; EUR-Lex CELEX:32024L0825)
• Implementing Reg: CELEX:32025R1960
• ESG News 2 Jun 2026 (letters of formal notice) · Linklaters EmpCo tracker + 9 Jul 2026 old-stock post · KPMG Law 9 Jan 2026 (DE transposition)
• BGH Press Release Nr. 138/2024 (I ZR 98/23, Katjes) · NL Times 10 Jul 2026 (KLM DKK 3M) · ESG Today 23 Feb 2024 (Zalando)
• Table.Briefings 11 Jun 2026 (Council abandons GCD talks) · Brussels Times 30 Jun 2026 (CPC old-stock Common Understanding)

Editions

• v1.0 · 2026-08-21 — First edition, built from the Official Journal text of Directive (EU) 2024/825 with pinpoint citations: the twelve new blacklist points verbatim, an 18-of-27 transposition scoreboard, the CPC old-stock Common Understanding of 30 Jun, and the Green Claims Directive recorded as stalled — not withdrawn, not law. Ships with the single-organisation licence and per-buyer watermarking.

SWIFT CSP Attestation Evidence Pack current to 2026-08-21 · edition 1.0

Pack page · changelog

Datasets behind the free guides

• S1 kit FACTS.md (verified 2026-08-21, ~34 lookups: SWIFT public CSP/attestation pages, the framework's own change overview, 8+ public assessor writeups) and kit file 04. RAIL (binding): controls identified by number + short official title only — titles are factual identifiers also published on SWIFT's public CSP pages; all descriptions are our own orientation at public-assessor-consensus level; nothing restates CSCF text. Buyers and readers are directed to download the CSCF v2026 themselves from SWIFT's Knowledge Centre (cscf_dd/70.0, free, no login).
• S1 kit FACTS.md (verified 2026-08-21): SWIFT public attestation pages [S4], the framework's own change overview [S2], swift.com figures [S5], 8+ public assessor writeups [S6–S13]. Same rail as controls.json: numbers + short official titles only; our own wording throughout; readers directed to their own CSCF v2026 download.

From the pack's verification file

S1 FACT PACK — SWIFT CSP / CSCF v2026 primary + assessor sources (verified 2026-08-21 by research agent, ~34 lookups)

• Internal build file — not shipped to buyers. Current to 21 August 2026. Independent publication by Kilde. Not affiliated with, endorsed by, or approved by S.W.I.F.T. SC. SWIFT is a registered trademark of S.W.I.F.T. SC.*
• SHIP DISCIPLINE ⚖ (copyright/confidentiality rail — verbatim, binding on every edit of every kit file): the CSCF v2026 PDF is publicly fetchable from SWIFT's Knowledge Centre but its Legal Notices mark it confidential ("Do not disclose this publication outside your organisation…"). The kit NEVER reproduces, excerpts, or closely paraphrases SWIFT's control text, implementation guidelines, or table layouts. Safe: control numbers + short official titles (e.g. "2.4 Back Office Data Flow Security") and the objective/principle names at heading level (factual identifiers also published on SWIFT's public CSP pages — audit C finding 7, 2026-08-21) as factual identifiers, plus OUR OWN original explanations built from the research summaries below and public assessor writeups. Every kit file instructs the buyer: "Download the CSCF v2026 yourself from SWIFT's Knowledge Centre (publication page cscf_dd/70.0 — free, no login) and verify every item in this pack against it." A local archive of the CSCF text exists at /private/tmp/claude-501/-Users-esau-claude-experiments/89372e5b-fbe8-4554-8606-7fd199250512/scratchpad/cscf2026_full.md — you may consult it ONLY to verify control numbers/short titles; never to source sentences; never ship or quote it. (Build note 2026-08-21: archive confirmed to be the v2026-compared-to-v2025 edition; the "2.4A" heading in it is a tracked-changes artifact of the old advisory marker — v2026 totals 26M+6A stand.)

Attestation mechanics (KYC-SA) [S4]

• Window: 1 July – 31 December 2026, annual; each year's control set goes live in KYC-SA early July.
• Re-attest within 3 months after material changes to the SWIFT-related infrastructure. New joiners attest before go-live.
• Consequences: SWIFT reserves the right to report to entity supervisors — late/absent attestation, attested non-compliance, missing independent assessment, or reliance on non-compliant providers (supervisors have real-time KYC-SA for Supervisors access). Counterparties see status color-coded: green valid / amber expired / grey none.

v2026 deltas (framework's own change overview [S2] + 8 assessor writeups [S6–S13])

• Customer client connectors became mandatory in-scope components of 14 controls: 1.2, 1.3, 1.4, 2.2, 2.3, 2.6, 2.7, 3.1, 4.1, 4.2, 5.1, 5.4, 6.1, 6.4. "Connector" now covers server or client endpoints connecting to a service provider or SWIFT — file-transfer clients, middleware, API integrations. Consequence (SWIFT's own wording, paraphrased): some prior Architecture-B users must now attest as A4.

Architecture types (paraphrased) [S1][S6–S13]

• A1 own communication interface · A2 own messaging interface, provider owns comms · A3 SWIFT-footprint connector on premises (Alliance Cloud SIL, Direct Link, Lite2 AutoClient, Microgateway) · A4 customer connector (file-transfer client/server, middleware, in-house app on SWIFT/provider APIs) app-to-app, incl. WebAccess front-end webservers · B no local footprint, humans in a browser GUI (operator PCs in scope as general-purpose PCs).

Control 2.4 — the wedge (original paraphrase only; never CSCF text)

• Purpose: confidentiality/integrity/authenticity of data between the user's SWIFT infrastructure and back-office FIRST HOPS (anti-tamper/injection on the payment-engine↔SWIFT corridor).

Misclassification traps (assessor-public)

Population / market

• 11,500+ connected institutions, 220+ countries (SWIFT's own figures [S5]).
• No customer-side templates from SWIFT (assessor-facing controls-matrix xlsx + report templates exist, login-gated).
• Zero productized packs on the market (Advisera returns nothing for SWIFT; marketplaces blank/blocked). Assessors publish no prices ("contact us"); SWIFT charges assessor firms €5k–20k/yr certification fees — market structure supports five-figure engagements.

Verification queue (mirror in kit/08)

• | # | Item | Status 2026-08-21 | Action |
• | Q6 | SWIFT 2026 reminder campaign | [UNVERIFIED] | Watch swift.com CSP news; affects ad-timing only |

Source URLs

• [S6] foregenix.com (2026-05-11) · [S7] foregenix.com (2026-08-04) · [S8] worldinformatixcs.com (2026-04-17) · [S9] blog.isecauditors.com (2025-07-01) · [S10] usd.de (2025-10-09) · [S11] infoguard.ch (2026-02-09) · [S12] elevateconsult.com (2026-06-26) · [S13] cybersigmacs.com · plus bdo.je (2026-05-29)

Editions

• v1.0 · 2026-08-21 — First edition, on the CSCF v2026 baseline: 32 controls (26 mandatory + 6 advisory), the control 2.4 promotion to mandatory, connector scope across 14 controls, and the KYC-SA window 1 Jul – 31 Dec 2026. Ships with the single-organisation licence and per-buyer watermarking.

HK Bank Review & Freeze Response Pack current to 2026-08-20 · edition 1.2

Pack page · changelog

Datasets behind the free guides

• V2 kit FACTS.md (verified 12 Aug 2026, re-verified 20 Aug 2026): HSBC CDD/Safeguard pages + TC accountant explainers (document stack, response protocol), Tam Sze Leung v Commissioner of Police [2024] HKCFA 8, HKMA De-risking circular 8 Sep 2016 (full PDF read, verbatim quotes cleared), Code of Banking Practice 7 Dec 2023 s.20.2/s.19.7, HKMA complaints pages, FDRC ToR (HK$1M/24-month verified vs Wayback), SFC circular 22 May 2026 ref 26EC29. Rails: genuine records only; counsel triggers hard-coded; 30-day notice never promised as absolute; HKMA framed as non-adjudicating.

From the pack's verification file

FACTS — 香港銀行審查・凍結戶口應對包 (V2-bank-freeze-pack)

• *Verified 12 August 2026 (research-agent sweep); re-verified 20 August 2026** (viability-recheck, EN+TC: zero productized competitors; no new SFC/HKMA circular since 22 May; official bodies still explanation-only — no templates, so the free-artifact kill-check stays untriggered; salience sustained: 「雷霆2026」 puppet-account operation 7–9 Aug — 147 arrests, HK$600M+ laundered; SFC froze HK$125M late Jul over suspected IPO fraud. Marketing rail re-affirmed: anchor on the legitimate-customer review/RFI scenario — the fresh headlines are mule-account busts, not innocent-customer stories. Detail: ../../reviews/2026-08-20-viability-recheck.md). Internal source of truth: every factual claim in the kit, landing page, and ads traces to this file. Items marked ⏳ sit in the verification queue (bottom) and are flagged inside the kit wherever cited. Do not "upgrade" a ⏳ claim to verbatim without closing the queue item.

1. The document stack banks demand (the kit's six categories)

2. Response protocol (PAT CPA)

3. Three distinct events (the kit's triage basis)

4. LNC case law and clock

• Tam Sze Leung v Commissioner of Police [2024] HKCFA 8 (10 April 2024): the Court of Final Appeal unanimously upheld the LNC regime as lawful. Remaining recourse: judicial review of the specific decision / negotiation with police–JFIU / civil routes — all counsel work.

5. Escalation path (and its hard limits)

• Bank's own complaints channel first → HKMA if no final reply within 30 days or the handling was unfair. The HKMA does NOT adjudicate disputes and cannot order compensation.
• FDRC mediation/arbitration for monetary disputes. VERIFIED 2026-08-20 (Q2 closed): Standard Eligible Disputes = claims up to HK$1,000,000, filed within 24 months of first knowledge of loss (Terms of Reference since 1 Jan 2018; the IFEC's HK$500,000/12-month figures are the pre-2018 regime only). Extended Eligible Disputes (> HK$1M / beyond 24 months) possible with both parties' consent. Eligible: individuals, sole proprietors, small enterprises (≤HK$50M turnover, ≤HK$50M gross assets, ≤50 HK employees). Precondition: written complaint to the FI first + final reply or 60 days' silence. Sources: fdrc.org.hk scope + FAQ pages (live site blocks bots; verified via Wayback snapshots incl. 2026-04-11 FAQ: web.archive.org/web/20260411050151/https://www.fdrc.org.hk/en/html/faqs/faqs_generalpublic.php).

6. Counsel triggers (hard hand-offs — no templates)

7. Regulatory backdrop (credibility + tracker)

• HKMA–HKAB Taskforce on SME Lending: ~590 enquiries AND cases by end-March 2025, ~90% handled. Framing discipline: always "enquiries and cases" — NEVER "590 de-banking cases." The April-2026 round is lending-focused (HK$450bn+ funds), not account access — do not conflate.
• SFC circular, 22 May 2026, ref 26EC29 (issued after reviewing 12 brokers; VERIFIED 2026-08-20, full text — Q5 closed): zero tolerance for questionable/forged documents in onboarding AND ongoing relationships (verbatim: "has zero tolerance for the use of questionable or forged documents in client onboarding or in maintaining ongoing client relationships"); closure of zero-balance dormant Mainland accounts runs "upon the SFC's request" on a risk-based selection of LCs (Measures 1–2) — NOT a blanket mandate; only Measure 3 (declarations for NEW Mainland-client accounts) applies to all LCs from the circular date; carve-out: dormant accounts need not close if the client keeps ≥1 non-dormant account (FAQ 3); additional measures apply to individual clients only (FAQ 10). "Zero-balance dormant" = no asset balance as of 22 May 2026 + no client-initiated activity in preceding 12 months. URL: apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermediaries/supervision/doc?refNo=26EC29 (BRDR mirror: brdr.hkma.gov.hk/eng/doc-ldg/docId/getPdf/20260522-13-EN/20260522-13-EN.pdf). ⚖ Kit/site must say "按要求／風險為本" — never "強制關閉全部".
• HKMA "De-risking and Financial Inclusion" circular (8 September 2016, ref B10/1C · B1/15C, signed Norman Chan) — VERIFIED 2026-08-20, full PDF read (Q1 closed). Canonical URL: brdr.hkma.gov.hk/eng/doc-ldg/docId/20160908-1-EN (the legacy hkma.gov.hk/media PDF link now serves an HTML shell — cite BRDR). Verbatim quotes now quotable in complaint letters: ¶2 "the HKMA expects AIs to adopt a risk-based approach (RBA) and refrain from adopting practices that would result in financial exclusion"; ¶3(a) "It is inappropriate for AIs to adopt a one-size-fits-all approach"; ¶3(b) "AIs should apply proportionate risk mitigating and CDD measures. It is inappropriate for AIs to impose requirements disproportionate to the risk level of the customer"; ¶5(b) "AIs should not use AML/CFT as the ground for closing or rejecting an account when it is actually for other considerations."
• Code of Banking Practice (HKAB + DTC Association, endorsed by HKMA), 7 Dec 2023 edition, Ch 2 s.20.2 — NEW citable right (Q4 closed): "Institutions should not close a customer's account without first giving at least 30 days' notice… Institutions should provide customers with the reason for closing their account. This will not apply in exceptional circumstances, for example, where the account is being used, or is suspected of being used, for illegal activities. Institutions should have a mechanism in place to review the decision of closing accounts upon the customer's request." (s.19.7 gives the same reasons+review for DECLINED openings.) URL: hkab.org.hk/files/page/code-of-bank/1/Code_of_Banking_Practice(7_Dec_2023)-1701936141.pdf. ⚖ The "exceptional circumstances" carve-out means suspected-illegal-activity closures can skip notice — never promise the 30 days as absolute.

8. Demand freshness (why now)

• HSBC walk-in restriction — DATE CORRECTED 2026-08-20 (Q7): the event is JUNE 2025, not 2026. From early June 2025 HSBC HK stopped branch/walk-in opening of HSBC One accounts for Mainland residents (Premier appointments kept); its updated opening guide published 10 Jun 2025 (Cailian: cls.cn/detail/2060027; archived web.archive.org/web/20260303035308). The June 2026 events are different: reported branch walk-in suspensions at BOCHK/Chinese banks late-May–Jun 2026 (HSBC and StanChart continued accepting); Bloomberg 4 Jun 2026 "HSBC, AIA Slump After Report of Hong Kong Bank Account Curbs"; SFC clarification ~10 Jun 2026 that licensed firms may keep serving Mainland clients.
• HSBC source-of-funds declaration deadlines (REPORTED, single source — NBD 18 Aug 2026, nbd.com.cn/articles/2026-08-18/4545174.html): Mainland investment clients who have not submitted SoF declarations reportedly face service suspension after 20 Aug 2026 and termination after 12 Sep 2026. ⚖ Single-source; kit/site may cite only as 據報 with date; tracker watches for confirmation.
• ZA Bank — timing precise (Q7 closed): termination notices EMAILED June 2026 setting JULY 2026 closure dates (not "July notices"). Notice verbatim: 「由於您的賬戶未能通過我們最近的內部審核」; ZA response verbatim: 「如個別賬戶出現註銷情況，屬該行按既定程序作出的處理安排，並非因應監管機構的指令而採取相關行動。」 Stable archives (created 2026-08-20): web.archive.org/web/20260820154254 (Sina mirror of Cailian 12 Jun) and web.archive.org/web/20260820154423 (The Paper 13 Jun, also naming HSBC/Hang Seng/StanChart/Ping An Securities HK).
• SFC fallout: all licensed firms are re-verifying client documents.

9. TC keyword set (landing / SEO / ads)

10. Competition (whitespace confirmed 2026-08-12)

Sources

• | S1 | HSBC HK — Safeguard / CDD information pages | https://www.hsbc.com.hk/help/banking/safeguard/ | ⏳ re-verify exact path |
• | S2 | HSBC Business (HK) — CDD document requests | https://www.business.hsbc.com.hk | ⏳ exact page |
• | S3 | PAT CPA — 銀行審查/凍結 explainer + response protocol | https://www.patcpa.com.hk | ⏳ exact article URL |
• | S4 | 毅思會計 (AC Group) — transaction-RFI document list | https://www.acgroup.com.hk | ⏳ exact article URL |
• | S5 | Planto — 戶口被凍結 explainer | https://www.planto.hk | ⏳ exact article URL |
• | S6 | Bizandbird — bank review explainer | https://www.bizandbird.com | ⏳ exact article URL |
• | S7 | Tam Sze Leung v Commissioner of Police [2024] HKCFA 8 | https://www.hklii.hk/en/cases/hkcfa/2024/8 | ✅ |
• | S8 | HKMA — De-risking and Financial Inclusion circular (8 Sep 2016) | https://brdr.hkma.gov.hk/eng/doc-ldg/docId/20160908-1-EN (legacy /media PDF link now serves HTML shell) | ✅ full text + verbatim quotes (2026-08-20) |
• | S9 | HKMA — Complaints about banks (30-day rule; no adjudication) | https://www.hkma.gov.hk/eng/smart-consumers/complaints-about-banks/ | ✅ |
• | S10 | FDRC — Financial Dispute Resolution Centre | https://www.fdrc.org.hk (site blocks bots; verified via Wayback snapshots to 2026-04-11) | ✅ cap verified HK$1M/24mo (2026-08-20) |
• | S11 | IFEC — complaint / dispute-resolution pages (HK$500k figure) | https://www.ifec.org.hk | ⏳ exact page |
• | S12 | SFC circulars gateway (22 May 2026 circular) | https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/ | ✅ gateway · ⏳ exact circular URL |
• | S13 | HKMA press releases — Taskforce end-Mar-2025 stats | https://www.hkma.gov.hk/eng/news-and-media/press-releases/ | ⏳ exact release URL |
• | S14 | JFIU — no-consent regime pages | https://www.jfiu.gov.hk | ✅ domain · ⏳ exact page |
• | S15 | HKAB — customer FAQ on reviews/closures | https://www.hkab.org.hk | ⏳ FAQ lines |
• | S16 | News: HSBC walk-in restriction (Jun 2025 — date corrected); ZA Bank notices (Jun 2026, closures Jul 2026); HSBC SoF deadlines (據報 NBD 18 Aug 2026) | archives: web.archive.org/web/20260820154254 · /20260820154423 · /20260303035308 | ✅ archived (2026-08-20) |
• Rail note: sources are cited and read manually — no government system is ever scraped or automated (founder veto 2026-07-14).*

Verification queue (mirrored in kit/08-update-tracker.md)

• | # | Item | Why it matters | Status 2026-08-12 |
• | Q1 | HKMA 2016 de-risking circular — verbatim proportionality quotes | Complaint letters may quote it; until then cite name + date only | ⏳ PDF blocked in research |
• | Q5 | Exact URL + verbatim scope lines of SFC 22 May 2026 circular | Landing + kit/07 cite it by date | ⏳ |
• | Q7 | Archive URLs: HSBC 10 Jun 2026 restriction; ZA Bank Jul 2026 notices | Demand-freshness claims on landing | ⏳ |

Editions

• v1.2 · 2026-08-21 — Single-organisation licence added to the pack (LICENCE.md); every delivered copy is now individually watermarked to the buyer.
• v1.2 · 2026-08-20 — Verification queue cleared, seven items: HKMA 2016 circular quoted verbatim into file 06; FDRC ceiling confirmed at HK$1M / 24 months; SFC circular wording made precise (on request / risk-based, not blanket); an HSBC walk-in date corrected to June 2025; Code of Banking Practice §20.2 added (30-day closure notice, reasons, review); ZA timeline made precise.
• v1.1 · 2026-08-20 — Full re-verification across English and Chinese sources: still no productised competitor; no new regulatory circulars since 22 May; official bodies still publish explanation, not templates.
• v1.0 · 2026-08-12 — First edition. Nine kit files and eight clean templates; verification queue Q1–Q7 opened.

HK Money-Lender Remediation Pack current to 2026-08-20 · edition 1.1

Pack page · changelog

From the pack's verification file

FACTS — HK Money-Lender Licensing-Conditions Remediation Pack (P2 · 放債人牌照條件合規包)

• *Verification status: primary source (CR guideline, April 2026 edition) read in full by research agent on 2026-08-12; re-verified 2026-08-20 (viability-recheck: CR "What's New" / licensing-conditions / publications pages show NO amendment, FAQ update, or enforcement item since 1 Aug; prescribed warning text re-extracted verbatim from the source PDF — unchanged; no grace period announced; no productized competitor in either language; LMLA member channel unverifiable — site 403s — standing watch as the likeliest origin of a future free template set. Detail: ../../reviews/2026-08-20-viability-recheck.md). Every claim in the kit, site, and ads must trace to this file. Pack is date-stamped "current to 20 August 2026" / 「資料截至2026年8月20日」**.

Sources

• | S1 | Companies Registry (as Registrar of Money Lenders), "Guidelines on Licensing Conditions of Money Lenders Licence", April 2026 edition, effective 1 August 2026 — 16 conditions + 9 annexes of sample forms | https://www.cr.gov.hk/en/publications/docs/Conditions_ML_e_Apr2026.pdf |
• | S2 | HKSAR Government press release, 1 August 2026 — confirms new conditions in force for all licences, no grace period | https://www.info.gov.hk/gia/general/202608/01/P2026073100772.htm |
• | S3 | FSTB consultation conclusions on enhanced regulation of licensed money lenders (incl. planned prudent-borrowing rewording of the warning statement; Phase-2 CDS numbers) | https://www.fstb.gov.hk |

Timeline

• 5 May 2026 — the 16 conditions begin to be imposed on new licences and renewals.
• 1 Aug 2026 — imposed on ALL licences (existing licences included). In force now. S2 confirms no grace period.
• 12 Aug 2026 — first full verification of the pack against S1.
• 20 Aug 2026 — re-verification: no changes at CR; warning text confirmed verbatim at source; current pack date.
• 1 Jun 2027 — Phase 2: Credit Data Smart (信資通) duties begin (see below).

The 16 conditions (April 2026 guideline order)

• | C13 | REFEREE BAN (revised) | Prohibited from requesting or obtaining ANY referee information. Referee information already held (obtained on or before 31 Jul 2026) must NOT be used and the referees must NOT be contacted for any purpose — retain but quarantine (retention flows from record-keeping; use/contact banned). |

C9 display specs (Annex 6)

Misleading-claims blacklist (paras 51–56)

Enforcement (real record — usable as urgency, always dated)

• S2 (1 Aug 2026 press release) confirms in force, no grace period.

Phase 2 — 1 June 2027 (tracker content)

Market & competition

• Competition: zero productized TC/EN compliance packs (verified 2026-08-12). The free competitor is the CR guideline itself with its 9 annex sample forms → this pack's value is the OPERATIONAL layer: DSR calculator, ad-spec conformity audit, audio scripts, bilingual written policies, evidence registers.

Distribution note (Lane B — SPEC)

⚖ Product rails (apply to every kit file + landing footer)

Annex / pinpoint map (guideline, April 2026)

Annex-8 worked examples (calculator test vectors — all income HK$6,000, 35% band, max HK$2,100/mo)

Editions

• v1.1 · 2026-08-21 — Single-organisation licence added to the pack (LICENCE.md); every delivered copy is now individually watermarked to the buyer.
• v1.1 · 2026-08-20 — Current edition: 16 licence conditions in force since 1 Aug 2026 with no transitional period; DSR calculation spec, affordability policy, advertising-compliance checklist, referee remediation memo and seven evidence registers.