Modules & architecture

What SanmigGRC supplies as the middleware layer between a participating institution's core systems and the DPIP Smart Registry.

1 · Registry Gateway

Validation, salting, SHA-256, JWS signing, mTLS, retry and idempotency across all six APIs. Edge Node replica for sub-100ms screening.

Simulated in this build

2 · Real-time Screening

Inline calls at onboarding, profile change, beneficiary addition, transaction initiation and inward credit. Fail-open or fail-closed is a bank policy setting.

Simulated in this build

3 · Mule & Behavioural Engine

Fan-in/fan-out, velocity, dormancy-then-burst, structuring, device sharing, profile-change-then-transfer. Produces candidates, never verdicts.

Simulated in this build

4 · Risk Scoring

Composite of registry status, identifier strength, corroborating institution count, source reliability, recency decay and bank-side behaviour.

Simulated in this build

5 · EDD & Case Management

Alert → Suspect/Cleared lifecycle, feedback posting, revoke and dispute with SLA tracking and full audit trail.

Simulated in this build

6 · External Intelligence Connectors

I4C/NCRP, NPCI, telecom regulatory bodies, LEA references, MuleHunter.ai outputs — each behind its own authorisation.

Requires separate authorisation

7 · DPDP & Audit Layer

Lawful-basis register, retention clock, access logging, data-principal grievance route for wrongly listed customers, evidence pack for RBI IT examination.

Design complete

Flowend to end

 XYZ BANK                      SANMIGGRC FRM CONNECTOR               IDPIC / DPIP
 ┌──────────┐                  ┌──────────────────────┐              ┌────────────┐
 │ CBS      │──txn event──────▶│ Screening orchestrator│──/check────▶│ Smart      │
 │ UPI/IMPS │                  │  ├ validation         │◀──status────│ Registry   │
 │ Onboard  │                  │  ├ salt + SHA-256     │   +score    │ (hashed)   │
 │ Channels │                  │  ├ JWS sign / mTLS    │             │            │
 └──────────┘                  │  └ Edge Node cache    │──/report───▶│            │
      ▲                        ├──────────────────────┤──/feedback─▶│            │
      │                        │ Behavioural engine    │──/revoke───▶│            │
      │                        │ Risk scoring          │──/dispute──▶│            │
 decision ◀────────────────────┤ Case / EDD workflow   │◀─/augment───│            │
 BLOCK / STEP-UP /             │ DPDP + audit layer    │  (proposed) └────────────┘
 MONITOR / ALLOW               └──────────────────────┘
                                          │
                                  external intelligence
                            I4C · NCRP · NPCI · telecom · LEA
                              (each under its own authorisation)

Where this build stopsdisclosure

Read before this goes anywhere near a bank. This is a functioning simulation of the integration contract, built from the DPIP product document and API inventory. It is not connected to IDPIC, and SanmigGRC holds no IDPIC empanelment, DPIP certification or vendor status. Use it as a UAT harness and a demonstration of the bank-side build, and say exactly that when you show it.

What is real

The workflow, the scoring model, the hashing pipeline and the API contract shape.

What is simulated

The registry itself, all entities, mule candidates and case records.

What is absent

Live credentials, production data, empanelment, and any regulator endorsement.