Smart Registry — local view
What the Edge Node holds: hashed identifiers, status, risk score, reporting-institution count and audit trail. No raw PII, by design.
—entities held
—suspect
—alert
—cleared
Registry entriesedge node replica
| Entity | Status | Score | PIs | Source | Identifiers (hashed) |
|---|---|---|---|---|---|
| building edge replica… | |||||
Hashes only. Even a full compromise of the edge replica yields no customer identity — reversing a salted SHA-256 identifier requires the bank's own salt, which never leaves the institution.
Risk scoring modelcomposite
| Factor | Weighting | Rationale |
|---|---|---|
| Registry status | SUSPECT 42 · ALERT 22 · CLEARED 4 | EDD-confirmed carries roughly double an unverified alert |
| Corroboration | +6 per additional reporting institution, capped +18 | Independent confirmation is the strongest available signal |
| Source reliability | LEA 16 · I4C/NCRP 15 · MuleHunter.ai 13 · NPCI 12 · internal model 9 | Externally corroborated beats self-generated |
| Recency decay | +10 decaying 0.25/day | A two-year-old flag should not carry today's weight |
| Identifier strength | Account 26 · Aadhaar 24 · PAN 22 · Mobile 20 · UPI 18 · Device 12 · IP 6 | Scales the registry score to how firmly the match identifies a person |
| Behavioural overlay | +9 to +16 per confirmed signal | Bank-side only — never sent to the central registry |
| Decision bands | ≥70 block · 45-69 step-up · 25-44 monitor · <25 allow | Thresholds are a bank policy setting, not a vendor default |
Why identifier type is weighted. A shared device ID or IP is weaker evidence than a matched bank account — households, cyber cafés and CGNAT produce false positives. Weighting by identifier strength is what keeps the false-positive rate survivable at national scale.