Skip to main content

ADR-0068: Country-Capability Registry & Honest "Not Assessed for X"

Status: Accepted Date: 2026-06-26 Deciders: Adrian (Soft4U) + Claude Opus 4.8 Milestone: M2 — Country-Capability Framework (docs/plans/2026-06-26-world-class-product-roadmap.md)

Decision-context​

The 2026-06-26 regression audit found a recurring root cause (H4·H5·H7·M16·M17·L6): compliance detectors had country vocabularies/parsers hardcoded to BE (+CZ) on the general investigation path. For Estonia (the OB Holding case) and every other EU member state, shell detection, geographic-concentration, adverse-corporate-history and address comparison silently returned a Belgian default / None / False — a false "no signal" indistinguishable from "checked-and-clean." This is the country-coverage form of the M1 false-reassurance problem (ADR-0067).

Decision​

A single country-capability registry (app/services/country_capability.py) is the source of truth for which jurisdictions each compliance signal can actually assess:

  1. Signal enum + is_assessable(signal, country) — the one assessability gate. A country a signal hasn't declared support for defaults to not assessable (EU-27-aware; None/unknown → False, never Belgium). No inline per-detector country sets — detectors consult the registry.
  2. country_capability_gap(signal, country) — the canonical honest-gap finding (DETERMINISTIC). When a detector is invoked for an unsupported country it emits this "not assessed for " signal instead of a silent default — extending ADR-0067's fail-closed contract to country coverage.
  3. Country-specific transforms (e.g. Belgian bilingual address canonicalisation) are gated behind the registry, so they never apply to the wrong jurisdiction and suppress a real discrepancy.

Consequences​

  • Positive: an EU-wide MLRO sees the truth — a signal is either genuinely assessed for the country or honestly flagged "not assessed for X." Belgian heuristics no longer leak onto Estonian (or any non-BE) data. Closes the BE/CZ-hardcoding cluster behind one registry.
  • Negative / accepted: more "not assessed" gaps surface for under-covered jurisdictions until per-country capability is deepened — intended (honest signal, not noise). Residual _POSTAL_CODE parser tables are now consulted only after the registry approves; their keys must track the registry (a documented sync point).

Implementation (M2)​

  • W1 (this delivery): registry + Signal enum + honest-gap finding; migrate H4 (shell + geographic concentration), H5 (adverse-corporate-history vocabulary), H7 (Belgian address canonicalisation).
  • W2: M16 (name_matching addresses), M17 (establishment-location FATF list + virtual-office), L6 (pure-mailbox status vocabulary) + per-country capability deepening.