diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml b/fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml
index 2c023d719..3e40835df 100644
--- a/fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml
@@ -501,7 +501,6 @@
     <include file="parts/0446_create_clerk_share_closure_request.xml" relativeToChangelogFile="true"/>
     <include file="parts/0447_add_tiered_thresholds_and_low_balance_rule.xml" relativeToChangelogFile="true"/>
     <include file="parts/0448_fill_client_risk_rule_income_turnover_nulls.xml" relativeToChangelogFile="true"/>
-    <include file="parts/0449_seed_aml_test_alerts.xml" relativeToChangelogFile="true"/>
     <include file="parts/0450_add_aml_rule_limit_bands.xml" relativeToChangelogFile="true"/>
     <include file="parts/0451_seed_branch_offices.xml" relativeToChangelogFile="true"/>
     <include file="parts/0452_seed_aml_manual_referral_rule.xml" relativeToChangelogFile="true"/>
@@ -523,7 +522,6 @@
     <include file="parts/0456_add_freeze_date_and_amount_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0457_add_unfreeze_date_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0458_add_no_debit_date_to_client_kyc.xml" relativeToChangelogFile="true"/>
-    <include file="parts/0459_seed_aml_alerts_awaiting_review.xml" relativeToChangelogFile="true"/>
     <include file="parts/0460_create_aml_recurring_review.xml" relativeToChangelogFile="true"/>
     <include file="parts/0461_add_pan_declaration_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0462_add_aadhaar_enrolment_receipt_to_client_kyc.xml" relativeToChangelogFile="true"/>
@@ -570,4 +568,7 @@
     <include file="parts/0491_add_funding_source_to_share_transaction.xml" relativeToChangelogFile="true"/>
     <include file="parts/0492_add_additional_collection_ids_to_share_transaction.xml" relativeToChangelogFile="true"/>
     <include file="parts/0493_enable_maker_checker_for_share_account_create.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0494_add_reconciliation_menu_permissions.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0495_merge_bank_cashier_role_into_cashier.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0496_merge_aml_officer_role_into_principal_officer.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0449_seed_aml_test_alerts.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0449_seed_aml_test_alerts.xml
deleted file mode 100644
index 5749f87d9..000000000
--- a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0449_seed_aml_test_alerts.xml
+++ /dev/null
@@ -1,108 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-
-    Licensed to the Apache Software Foundation (ASF) under one
-    or more contributor license agreements. See the NOTICE file
-    distributed with this work for additional information
-    regarding copyright ownership. The ASF licenses this file
-    to you under the Apache License, Version 2.0 (the
-    "License"); you may not use this file except in compliance
-    with the License. You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing,
-    software distributed under the License is distributed on an
-    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-    KIND, either express or implied. See the License for the
-    specific language governing permissions and limitations
-    under the License.
-
--->
-<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
-                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
-
-    <changeSet author="fineract" id="0449-1">
-        <preConditions onFail="MARK_RAN">
-            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM m_client WHERE external_id = 'CLIENT_RAJESH'</sqlCheck>
-        </preConditions>
-        <sql>
-            INSERT INTO m_client (
-                account_no, external_id, status_enum, office_id, display_name,
-                fullname, is_staff, activation_date, office_joining_date,
-                submittedon_date, legal_form_enum,
-                created_on_utc, created_by,
-                last_modified_on_utc, last_modified_by,
-                cif_number
-            )
-            VALUES 
-            (
-                'ACC0000002', 'CLIENT_RAJESH', 300, 1, 'Rajesh Kumar',
-                'Rajesh Kumar', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 1,
-                NOW(), 1,
-                NOW(), 1,
-                'CIF_RAJESH'
-            ),
-            (
-                'ACC0000003', 'CLIENT_SONIA', 300, 1, 'Sonia Sharma',
-                'Sonia Sharma', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 1,
-                NOW(), 1,
-                NOW(), 1,
-                'CIF_SONIA'
-            ),
-            (
-                'ACC0000004', 'CLIENT_VIKRAM', 300, 1, 'Vikram Malhotra',
-                'Vikram Malhotra', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 1,
-                NOW(), 1,
-                NOW(), 1,
-                'CIF_VIKRAM'
-            );
-        </sql>
-    </changeSet>
-
-    <changeSet author="fineract" id="0449-2">
-        <preConditions onFail="MARK_RAN">
-            <sqlCheck expectedResult="0">
-                SELECT COUNT(*) FROM m_aml_alert a 
-                JOIN m_client c ON a.client_id = c.id 
-                WHERE c.external_id IN ('CLIENT_RAJESH', 'CLIENT_SONIA', 'CLIENT_VIKRAM')
-            </sqlCheck>
-        </preConditions>
-        <sql>
-            INSERT INTO m_aml_alert (
-                transaction_type, transaction_id, client_id, rule_id, amount, currency_code,
-                raised_on, status, created_by, created_on_utc, last_modified_by, last_modified_on_utc, version
-            )
-            VALUES
-            (
-                'SAVINGS', 1001, 
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_RAJESH'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'LARGE_CASH_TXN_25L'),
-                3500000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            ),
-            (
-                'SAVINGS', 1002, 
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_SONIA'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'STRUCTURING_BELOW_10L'),
-                995000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            ),
-            (
-                'SAVINGS', 1003, 
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_VIKRAM'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'PEP_ACCOUNT_MONITORING'),
-                75000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            );
-        </sql>
-    </changeSet>
-
-</databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0459_seed_aml_alerts_awaiting_review.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0459_seed_aml_alerts_awaiting_review.xml
deleted file mode 100644
index eb2a6b00b..000000000
--- a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0459_seed_aml_alerts_awaiting_review.xml
+++ /dev/null
@@ -1,72 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-
-    Licensed to the Apache Software Foundation (ASF) under one
-    or more contributor license agreements. See the NOTICE file
-    distributed with this work for additional information
-    regarding copyright ownership. The ASF licenses this file
-    to you under the Apache License, Version 2.0 (the
-    "License"); you may not use this file except in compliance
-    with the License. You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing,
-    software distributed under the License is distributed on an
-    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-    KIND, either express or implied. See the License for the
-    specific language governing permissions and limitations
-    under the License.
-
--->
-<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
-                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
-
-    <!--
-        Two alerts left in RAISED so the Whitelist / Suspicious actions on the AML Rules Master
-        "Flagged Transactions" tab can be exercised. The alerts seeded in 0449 have all been
-        dispositioned, which correctly hides the buttons and leaves nothing to test against.
-
-        Transaction ids 2001/2002 are stubs — they do not point at rows in m_savings_account_transaction.
-        That is deliberate and matches 0449: the review path (whitelist, or escalate opening an STR
-        case) reads only the alert row, so a stub id exercises the full workflow. Only a screen that
-        drills through to the underlying transaction would notice.
-    -->
-    <changeSet author="Antigravity" id="0459-1">
-        <preConditions onFail="MARK_RAN">
-            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM m_aml_alert WHERE transaction_id IN (2001, 2002)</sqlCheck>
-            <sqlCheck expectedResult="2">
-                SELECT COUNT(*) FROM m_client WHERE external_id IN ('CLIENT_RAJESH', 'CLIENT_SONIA')
-            </sqlCheck>
-            <sqlCheck expectedResult="2">
-                SELECT COUNT(*) FROM m_aml_transaction_rule
-                WHERE rule_code IN ('LARGE_CASH_TXN_25L', 'STRUCTURING_BELOW_10L')
-            </sqlCheck>
-        </preConditions>
-        <sql>
-            INSERT INTO m_aml_alert (
-                transaction_type, transaction_id, client_id, rule_id, amount, currency_code,
-                raised_on, status, created_by, created_on_utc, last_modified_by, last_modified_on_utc, version
-            )
-            VALUES
-            (
-                'SAVINGS', 2001,
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_RAJESH'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'LARGE_CASH_TXN_25L'),
-                4200000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            ),
-            (
-                'SAVINGS', 2002,
-                (SELECT id FROM m_client WHERE external_id = 'CLIENT_SONIA'),
-                (SELECT id FROM m_aml_transaction_rule WHERE rule_code = 'STRUCTURING_BELOW_10L'),
-                980000.000000, 'INR',
-                NOW(), 'RAISED',
-                1, NOW(), 1, NOW(), 0
-            );
-        </sql>
-    </changeSet>
-
-</databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0494_add_reconciliation_menu_permissions.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0494_add_reconciliation_menu_permissions.xml
new file mode 100644
index 000000000..6334e2a43
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0494_add_reconciliation_menu_permissions.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
+
+    <!--
+        The Cash/Clearing Reconciliation module (0018_cash_reconciliation.xml,
+        0393_clearing_settlement_reconciliation.xml, and their per-action permissions such as
+        CREATE_CASHRECONCILIATION / READ_CLEARINGRECONCILIATION) is live, but the three
+        top-level permissions that gate its own nav entry and section-level read access were
+        never seeded by any migration: this dev database only has them because they were
+        inserted by hand at some point. Without this file a fresh database would build and
+        expose the reconciliation screens with no way to grant a role access to them at all.
+    -->
+    <changeSet id="0494-reconciliation-nav-permissions" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">SELECT COUNT(*) FROM m_permission WHERE code = 'MENU_RECONCILIATION'</sqlCheck>
+        </preConditions>
+        <insert tableName="m_permission">
+            <column name="grouping" value="heading_menu"/>
+            <column name="code" value="MENU_RECONCILIATION"/>
+            <column name="entity_name" value="MENU"/>
+            <column name="action_name" value="RECONCILIATION"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="reconciliation"/>
+            <column name="code" value="READ_RECONCILIATION"/>
+            <column name="entity_name" value="RECONCILIATION"/>
+            <column name="action_name" value="READ"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="special"/>
+            <column name="code" value="SIDEBAR_RECONCILIATION"/>
+            <column name="entity_name" value="SIDEBAR_RECONCILIATION"/>
+            <column name="action_name" value="READ"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0495_merge_bank_cashier_role_into_cashier.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0495_merge_bank_cashier_role_into_cashier.xml
new file mode 100644
index 000000000..9a191c03a
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0495_merge_bank_cashier_role_into_cashier.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
+
+    <!--
+        "CASHIER" and "Bank Cashier" were two separate roles covering overlapping teller duties;
+        "Bank Cashier" only ever carried 4 fund-transfer permissions that CASHIER didn't already
+        have. Folds Bank Cashier into CASHIER: copies its permissions onto CASHIER, moves any
+        users still assigned to Bank Cashier onto CASHIER, then removes the now-redundant role.
+        Written to run in this order so no user or permission mapping is ever briefly unowned.
+    -->
+
+    <changeSet id="0495-copy-bank-cashier-permissions-to-cashier" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Bank Cashier'</sqlCheck>
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'CASHIER'</sqlCheck>
+        </preConditions>
+        <sql>
+            INSERT INTO m_role_permission (role_id, permission_id)
+            SELECT (SELECT id FROM m_role WHERE name = 'CASHIER'), bc_rp.permission_id
+            FROM m_role_permission bc_rp
+            WHERE bc_rp.role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier')
+              AND bc_rp.permission_id NOT IN (
+                  SELECT permission_id FROM m_role_permission
+                  WHERE role_id = (SELECT id FROM m_role WHERE name = 'CASHIER')
+              );
+        </sql>
+    </changeSet>
+
+    <changeSet id="0495-move-bank-cashier-users-to-cashier" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Bank Cashier'</sqlCheck>
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'CASHIER'</sqlCheck>
+        </preConditions>
+        <sql>
+            INSERT INTO m_appuser_role (appuser_id, role_id)
+            SELECT bc_ur.appuser_id, (SELECT id FROM m_role WHERE name = 'CASHIER')
+            FROM m_appuser_role bc_ur
+            WHERE bc_ur.role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier')
+              AND bc_ur.appuser_id NOT IN (
+                  SELECT appuser_id FROM m_appuser_role
+                  WHERE role_id = (SELECT id FROM m_role WHERE name = 'CASHIER')
+              );
+
+            DELETE FROM m_appuser_role
+            WHERE role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier');
+        </sql>
+    </changeSet>
+
+    <changeSet id="0495-remove-bank-cashier-role" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Bank Cashier'</sqlCheck>
+        </preConditions>
+        <sql>
+            DELETE FROM m_role_permission WHERE role_id = (SELECT id FROM m_role WHERE name = 'Bank Cashier');
+            DELETE FROM m_role WHERE name = 'Bank Cashier';
+        </sql>
+    </changeSet>
+
+</databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0496_merge_aml_officer_role_into_principal_officer.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0496_merge_aml_officer_role_into_principal_officer.xml
new file mode 100644
index 000000000..31d7ed93a
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0496_merge_aml_officer_role_into_principal_officer.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
+
+    <!--
+        "AML Officer" (MENU_AML_COMPLIANCE, REVIEW_AML_ALERT) is a strict subset of "Principal
+        Officer" (same two, plus CONCLUDE_AML_STR), so this is a straight removal, not a copy:
+        nothing AML Officer grants is missing from Principal Officer already. Moves any users
+        still on AML Officer onto Principal Officer first (defensive: this dev database has
+        none on either role, but other environments may), then removes the now-redundant role.
+    -->
+
+    <changeSet id="0496-move-aml-officer-users-to-principal-officer" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'AML Officer'</sqlCheck>
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'Principal Officer'</sqlCheck>
+        </preConditions>
+        <sql>
+            INSERT INTO m_appuser_role (appuser_id, role_id)
+            SELECT ao_ur.appuser_id, (SELECT id FROM m_role WHERE name = 'Principal Officer')
+            FROM m_appuser_role ao_ur
+            WHERE ao_ur.role_id = (SELECT id FROM m_role WHERE name = 'AML Officer')
+              AND ao_ur.appuser_id NOT IN (
+                  SELECT appuser_id FROM m_appuser_role
+                  WHERE role_id = (SELECT id FROM m_role WHERE name = 'Principal Officer')
+              );
+
+            DELETE FROM m_appuser_role
+            WHERE role_id = (SELECT id FROM m_role WHERE name = 'AML Officer');
+        </sql>
+    </changeSet>
+
+    <changeSet id="0496-remove-aml-officer-role" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="1">SELECT COUNT(*) FROM m_role WHERE name = 'AML Officer'</sqlCheck>
+        </preConditions>
+        <sql>
+            DELETE FROM m_role_permission WHERE role_id = (SELECT id FROM m_role WHERE name = 'AML Officer');
+            DELETE FROM m_role WHERE name = 'AML Officer';
+        </sql>
+    </changeSet>
+
+</databaseChangeLog>