Merge remote-tracking branch 'origin/dev-latest' into feature/dds-agent-settlement-reports

# Conflicts:
#	fineract-core/src/main/java/org/apache/fineract/commands/service/CommandWrapperBuilder.java
#	fineract-core/src/main/java/org/apache/fineract/infrastructure/jobs/service/JobName.java
#	fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

fineract-provider/src/main/java/org/apache/fineract/accounting/balancesheet/api/BalanceSheetApiResource.java

@@ -0,0 +1,243 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.balancesheet.api;
+
+import com.google.gson.Gson;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * An "as on date" balance sheet built directly off the live chart of accounts and journal entries,
+ * rather than a stock Fineract trial balance report — this reproduces the specific sub-group-wise
+ * layout this bank's own paper balance sheet uses: every top-level Header account (Capital, Deposit
+ * Account, Other Liabilities, ...) is one named block, with its Detail (and any nested Header)
+ * children indented underneath it and a subtotal on the block itself. A Detail account with no
+ * Header at all (see GLAccountTransactionGuard's sibling concern - some accounts are seeded standalone)
+ * still needs to appear somewhere, so it is listed as its own root-level line rather than silently
+ * dropped.
+ *
+ * A Header account never itself carries a journal entry (see the header/detail discussion this
+ * feature grew out of), so its balance is always the recursive sum of its children - never read off
+ * acc_gl_journal_entry directly.
+ */
+@Path("/v1/accounting/balancesheet")
+@Component
+@RequiredArgsConstructor
+@Produces({ MediaType.APPLICATION_JSON })
+public class BalanceSheetApiResource {
+
+    private static final String RESOURCE_NAME_FOR_PERMISSION = "GLACCOUNT";
+
+    private final PlatformSecurityContext context;
+    private final JdbcTemplate jdbcTemplate;
+    private final Gson gson = new Gson();
+
+    // classification_enum values (see acc_gl_account / GLAccountType).
+    private static final int ASSET = 1;
+    private static final int LIABILITY = 2;
+    private static final int EQUITY = 3;
+    private static final int INCOME = 4;
+    private static final int EXPENSE = 5;
+    // account_usage values (see GLAccountUsage).
+    private static final int DETAIL = 1;
+    private static final int HEADER = 2;
+
+    private static final class Node {
+
+        Long id;
+        String name;
+        String glCode;
+        int usage;
+        int classification;
+        Long parentId;
+        BigDecimal ownBalance = BigDecimal.ZERO;
+        final List<Node> children = new ArrayList<>();
+
+        BigDecimal balance() {
+            if (usage == DETAIL) {
+                return ownBalance;
+            }
+            BigDecimal sum = BigDecimal.ZERO;
+            for (final Node child : children) {
+                sum = sum.add(child.balance());
+            }
+            return sum;
+        }
+
+        Map<String, Object> toJson() {
+            final Map<String, Object> json = new LinkedHashMap<>();
+            json.put("id", id);
+            json.put("name", name);
+            json.put("glCode", glCode);
+            json.put("usage", usage == HEADER ? "HEADER" : "DETAIL");
+            json.put("balance", balance());
+            final List<Map<String, Object>> childJson = new ArrayList<>();
+            for (final Node child : children) {
+                childJson.add(child.toJson());
+            }
+            json.put("children", childJson);
+            return json;
+        }
+    }
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    public String retrieveBalanceSheet(@QueryParam("asOnDate") final String asOnDateParam,
+            @QueryParam("officeId") final Long officeId) {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSION);
+
+        final LocalDate asOnDate = (asOnDateParam == null || asOnDateParam.isBlank()) ? DateUtils.getBusinessLocalDate()
+                : LocalDate.parse(asOnDateParam);
+
+        final Map<Long, Node> nodesById = new LinkedHashMap<>();
+        for (final Map<String, Object> row : this.jdbcTemplate.queryForList(
+                "SELECT id, name, gl_code, parent_id, account_usage, classification_enum FROM acc_gl_account "
+                        + "WHERE disabled = false ORDER BY gl_code")) {
+            final Node node = new Node();
+            node.id = ((Number) row.get("id")).longValue();
+            node.name = (String) row.get("name");
+            node.glCode = (String) row.get("gl_code");
+            node.parentId = row.get("parent_id") == null ? null : ((Number) row.get("parent_id")).longValue();
+            node.usage = ((Number) row.get("account_usage")).intValue();
+            node.classification = ((Number) row.get("classification_enum")).intValue();
+            nodesById.put(node.id, node);
+        }
+
+        // entry_date (not transaction_date) and "reversed = false" are this codebase's settled
+        // convention for reading balances off the ledger - ProfitAndLossApiResource, the dividend
+        // reports and IncomeProfitTransferService all cut the same way, so this report agrees with
+        // them rather than quietly producing a second set of numbers.
+        //
+        // The reversal_id exclusion covers a case that plain "reversed = false" gets wrong. This
+        // codebase reverses in two different ways: the clerk/sponsor-DD undo paths just flip the
+        // flag on the original leg (no counter entry - excluding it is exactly right), while
+        // Fineract's own revertJournalEntry additionally posts an opposite-sign counter entry and
+        // links it back through reversal_id. For that second kind, dropping only the original would
+        // leave its counter entry standing alone and swing the balance by the full amount in the
+        // wrong direction, so the counter entry has to go too.
+        final Map<Long, BigDecimal[]> balances = new LinkedHashMap<>();
+        final String balanceSql = "SELECT account_id, "
+                + "COALESCE(SUM(CASE WHEN type_enum = 2 THEN amount ELSE 0 END), 0) AS total_debit, "
+                + "COALESCE(SUM(CASE WHEN type_enum = 1 THEN amount ELSE 0 END), 0) AS total_credit "
+                + "FROM acc_gl_journal_entry WHERE entry_date <= ? "
+                + "AND (reversed IS NULL OR reversed = false) "
+                + "AND id NOT IN (SELECT reversal_id FROM acc_gl_journal_entry WHERE reversal_id IS NOT NULL)"
+                + (officeId != null ? " AND office_id = ?" : "") + " GROUP BY account_id";
+        final List<Map<String, Object>> balanceRows = officeId != null
+                ? this.jdbcTemplate.queryForList(balanceSql, java.sql.Date.valueOf(asOnDate), officeId)
+                : this.jdbcTemplate.queryForList(balanceSql, java.sql.Date.valueOf(asOnDate));
+        for (final Map<String, Object> row : balanceRows) {
+            balances.put(((Number) row.get("account_id")).longValue(),
+                    new BigDecimal[] { (BigDecimal) row.get("total_debit"), (BigDecimal) row.get("total_credit") });
+        }
+
+        for (final Node node : nodesById.values()) {
+            if (node.usage != DETAIL) {
+                continue;
+            }
+            final BigDecimal[] debitCredit = balances.get(node.id);
+            if (debitCredit == null) {
+                continue;
+            }
+            final boolean debitNatured = node.classification == ASSET || node.classification == EXPENSE;
+            node.ownBalance = debitNatured ? debitCredit[0].subtract(debitCredit[1]) : debitCredit[1].subtract(debitCredit[0]);
+        }
+
+        final List<Node> roots = new ArrayList<>();
+        for (final Node node : nodesById.values()) {
+            if (node.parentId == null) {
+                roots.add(node);
+            } else {
+                final Node parent = nodesById.get(node.parentId);
+                if (parent != null) {
+                    parent.children.add(node);
+                } else {
+                    // Parent was disabled (filtered out above) - surface this node at the top level
+                    // rather than silently losing its balance from the report.
+                    roots.add(node);
+                }
+            }
+        }
+
+        final Map<String, Object> debitSide = buildSide("ASSETS", roots, ASSET, EXPENSE);
+        final Map<String, Object> creditSide = buildSide("LIABILITIES", roots, LIABILITY, EQUITY, INCOME);
+
+        final Map<String, Object> response = new LinkedHashMap<>();
+        response.put("asOnDate", asOnDate.toString());
+        response.put("officeId", officeId);
+        response.put("debitSide", debitSide);
+        response.put("creditSide", creditSide);
+        return this.gson.toJson(response);
+    }
+
+    private Map<String, Object> buildSide(final String label, final List<Node> roots, final int... classifications) {
+        final List<Map<String, Object>> groups = new ArrayList<>();
+        BigDecimal sideTotal = BigDecimal.ZERO;
+        for (final int classification : classifications) {
+            final List<Map<String, Object>> nodeJsons = new ArrayList<>();
+            BigDecimal groupTotal = BigDecimal.ZERO;
+            for (final Node root : roots) {
+                if (root.classification != classification) {
+                    continue;
+                }
+                nodeJsons.add(root.toJson());
+                groupTotal = groupTotal.add(root.balance());
+            }
+            if (!nodeJsons.isEmpty()) {
+                final Map<String, Object> group = new LinkedHashMap<>();
+                group.put("classification", classificationLabel(classification));
+                group.put("total", groupTotal);
+                group.put("nodes", nodeJsons);
+                groups.add(group);
+                sideTotal = sideTotal.add(groupTotal);
+            }
+        }
+        final Map<String, Object> side = new LinkedHashMap<>();
+        side.put("label", label);
+        side.put("total", sideTotal);
+        side.put("groups", groups);
+        return side;
+    }
+
+    private String classificationLabel(final int classification) {
+        return switch (classification) {
+            case ASSET -> "ASSET";
+            case LIABILITY -> "LIABILITY";
+            case EQUITY -> "EQUITY";
+            case INCOME -> "INCOME";
+            case EXPENSE -> "EXPENSE";
+            default -> "OTHER";
+        };
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/common/DividendGlAccountResolver.java

@@ -0,0 +1,112 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.common;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.accounting.common.AccountingConstants.FinancialActivity;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+
+/**
+ * Resolves the GL accounts the dividend lifecycle posts to, from the Financial Activity Mappings an administrator
+ * configures.
+ *
+ * <p>
+ * These accounts used to be found by hardcoded GL code - {@code BANKPROFITND01} and {@code BANKPROFIT01} - spread
+ * across five classes. A society whose chart of accounts did not happen to use those exact codes got no dividend
+ * journal entries at all, and nothing said so: every call site checked for null and returned quietly. Reading them from
+ * the mapping table instead lets each society name its own accounts, and keeps the whole lifecycle answerable from one
+ * screen.
+ *
+ * <p>
+ * Resolution is mapping-only, with no fallback to the old codes: a society that has not mapped an account has not made
+ * the decision yet, and quietly posting to an account it never chose is worse than refusing. Every method here throws
+ * rather than returning null, so a missing mapping surfaces at the point of posting with the name of the activity to
+ * configure, instead of leaving a declaration that appears to have worked but moved nothing.
+ */
+@Service
+@RequiredArgsConstructor
+public class DividendGlAccountResolver {
+
+    private final JdbcTemplate jdbcTemplate;
+
+    /** The year's closed-out profit a dividend is declared against. */
+    public Long distributableProfitAccount() {
+        return requireMapped(FinancialActivity.DISTRIBUTABLE_PROFIT);
+    }
+
+    /** Where profit settles once it is no longer distributable: the undistributed remainder, rounding, forfeitures. */
+    public Long retainedProfitAccount() {
+        return requireMapped(FinancialActivity.RETAINED_PROFIT);
+    }
+
+    /** Equity the declared profit is set aside in, between declaration and board approval. */
+    public Long reserveForDividendAccount() {
+        return requireMapped(FinancialActivity.RESERVE_FOR_DIVIDEND);
+    }
+
+    /** The liability to members, created on approval and discharged as each member claims. */
+    public Long payableDividendsAccount() {
+        return requireMapped(FinancialActivity.PAYABLE_DIVIDENDS);
+    }
+
+    /**
+     * Where the paise a dividend cannot divide evenly are swept.
+     *
+     * Falls back to retained profit when unmapped, which is exactly where the residue went before this account existed
+     * - so a society that does not care to separate it keeps the behaviour it already had, and one that maps it gets
+     * the arithmetic artefact out of a figure it reads as a business result. This is a presentation choice rather than
+     * a decision the society has failed to make, which is why it resolves rather than throwing.
+     */
+    public Long dividendRoundOffAccount() {
+        final Long roundOff = mappedAccount(FinancialActivity.DIVIDEND_ROUND_OFF);
+        return roundOff != null ? roundOff : retainedProfitAccount();
+    }
+
+    /**
+     * Contra the claim is routed through, so claimed and unclaimed read as two balances rather than one net figure.
+     *
+     * Optional by design - a society that has not mapped it still gets a correct payout, posted straight from Dividend
+     * Payable, just without that separate measure. This is the one account here that may legitimately be absent, so it
+     * returns null instead of throwing.
+     */
+    public Long dividendPaidAccountOrNull() {
+        return mappedAccount(FinancialActivity.DIVIDEND_PAID);
+    }
+
+    /** The GL mapped to an activity, or null when the society has not configured it. */
+    public Long mappedAccount(final FinancialActivity activity) {
+        return this.jdbcTemplate
+                .queryForList("SELECT gl_account_id FROM acc_gl_financial_activity_account WHERE financial_activity_type = ?", Long.class,
+                        activity.getValue())
+                .stream().findFirst().orElse(null);
+    }
+
+    private Long requireMapped(final FinancialActivity activity) {
+        final Long glAccountId = mappedAccount(activity);
+        if (glAccountId == null) {
+            throw new GeneralPlatformDomainRuleException("error.msg.financial.activity.mapping." + activity.getCode() + ".not.configured",
+                    "No GL account is mapped to the '" + activity + "' financial activity. Map one under Accounting > Financial Activity "
+                            + "Mappings before running the dividend cycle.",
+                    activity.getValue());
+        }
+        return glAccountId;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/dividendpaidreport/api/DividendYearwiseReportApiResource.java

@@ -0,0 +1,185 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.dividendpaidreport.api;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Every declared dividend, financial year by financial year: how much was declared, how much members have collected,
+ * how much is still unclaimed, and how much has come back to profit.
+ *
+ * The GL accounts are shared across years, so their balances only ever give running totals — "how much of FY 2026-27 is
+ * still unclaimed" cannot be read off Dividend Payable. This walks the declarations themselves instead: locks carry the
+ * per-member entitlement and their status says what became of it, which is the authoritative record. The GL is where the
+ * money moved; the locks are what it moved for.
+ *
+ * The columns mirror the money's actual path, which begins and ends in the same place:
+ *
+ * <pre>
+ *   declare          Dr Bank Profit        Cr Dividend Payable
+ *   member claims    Dr Dividend Payable   Cr Dividend Paid  →  Cr Sponsor DD Payable
+ *   3 yrs unclaimed  Dr Dividend Payable   Cr Bank Profit
+ * </pre>
+ *
+ * So for a closed year, claimed + forfeited + rounding residue should account for the whole declaration; anything left
+ * is what is still sitting unclaimed and still within its three-year window.
+ */
+@Path("/v1/accounting/dividend-yearwise-report")
+@Component
+@Tag(name = "Dividend Year-wise Report", description = "Declared, claimed, unclaimed and forfeited dividend per financial year.")
+@RequiredArgsConstructor
+public class DividendYearwiseReportApiResource {
+
+    private static final String RESOURCE_NAME_FOR_PERMISSIONS = "DIVIDEND_SHAREPRODUCT";
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public String report() {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSIONS);
+
+        // A declaration is labelled by the financial year its period CLOSES in, which is how a member
+        // and an auditor both refer to it: a period ending 31-Mar-2027 is FY 2026-27. Locks are joined
+        // through the per-member detail rather than counted off the declaration, because a lock is only
+        // created for a member who actually had something to collect.
+        // Declared amounts and lock outcomes are aggregated separately before being joined by year.
+        // Summing the declaration amount across a join to its locks would multiply it by the number
+        // of members it was split between.
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                WITH fy AS (
+                    SELECT d.id,
+                           CASE WHEN EXTRACT(MONTH FROM d.dividend_period_end_date) >= 4
+                                THEN EXTRACT(YEAR FROM d.dividend_period_end_date)
+                                ELSE EXTRACT(YEAR FROM d.dividend_period_end_date) - 1 END AS fy_start,
+                           d.amount
+                    FROM m_share_product_dividend_pay_out d
+                ),
+                declared AS (
+                    SELECT fy_start, COUNT(*) AS declaration_count, SUM(amount) AS declared_amount
+                    FROM fy GROUP BY fy_start
+                ),
+                outcomes AS (
+                    SELECT fy.fy_start,
+                           COALESCE(SUM(CASE WHEN l.status = 'CLAIMED'   THEN l.amount ELSE 0 END), 0) AS claimed_amount,
+                           COUNT(l.id) FILTER (WHERE l.status = 'CLAIMED')   AS claimed_count,
+                           COALESCE(SUM(CASE WHEN l.status = 'UNCLAIMED' THEN l.amount ELSE 0 END), 0) AS unclaimed_amount,
+                           COUNT(l.id) FILTER (WHERE l.status = 'UNCLAIMED') AS unclaimed_count,
+                           COALESCE(SUM(CASE WHEN l.status = 'FORFEITED' THEN l.amount ELSE 0 END), 0) AS forfeited_amount,
+                           COUNT(l.id) FILTER (WHERE l.status = 'FORFEITED') AS forfeited_count,
+                           MIN(l.release_due_date) FILTER (WHERE l.status = 'UNCLAIMED') AS earliest_release_due
+                    FROM fy
+                    LEFT JOIN m_share_account_dividend_details sad ON sad.dividend_pay_out_id = fy.id
+                    LEFT JOIN m_share_dividend_lock l ON l.dividend_detail_id = sad.id
+                    GROUP BY fy.fy_start
+                )
+                SELECT d.fy_start, d.declaration_count, d.declared_amount,
+                       COALESCE(o.claimed_amount, 0) AS claimed_amount, COALESCE(o.claimed_count, 0) AS claimed_count,
+                       COALESCE(o.unclaimed_amount, 0) AS unclaimed_amount, COALESCE(o.unclaimed_count, 0) AS unclaimed_count,
+                       COALESCE(o.forfeited_amount, 0) AS forfeited_amount, COALESCE(o.forfeited_count, 0) AS forfeited_count,
+                       o.earliest_release_due
+                FROM declared d
+                LEFT JOIN outcomes o ON o.fy_start = d.fy_start
+                ORDER BY d.fy_start DESC
+                """);
+
+        // Rounding residue is tracked per declaration rather than per lock — it never belonged to a
+        // member, so no lock was ever created for it. Pulled separately and matched by year.
+        final Map<String, BigDecimal> residueByYear = new LinkedHashMap<>();
+        for (final Map<String, Object> row : jdbcTemplate.queryForList("""
+                SELECT CASE WHEN EXTRACT(MONTH FROM period_end_date) >= 4
+                            THEN EXTRACT(YEAR FROM period_end_date)
+                            ELSE EXTRACT(YEAR FROM period_end_date) - 1 END AS fy_start,
+                       COALESCE(SUM(residue_amount), 0) AS residue
+                FROM m_share_dividend_rounding_residue
+                GROUP BY fy_start
+                """)) {
+            residueByYear.put(financialYearLabel(((Number) row.get("fy_start")).intValue()), (BigDecimal) row.get("residue"));
+        }
+
+        final List<Map<String, Object>> years = new ArrayList<>();
+        BigDecimal totalDeclared = BigDecimal.ZERO;
+        BigDecimal totalClaimed = BigDecimal.ZERO;
+        BigDecimal totalUnclaimed = BigDecimal.ZERO;
+        BigDecimal totalForfeited = BigDecimal.ZERO;
+
+        for (final Map<String, Object> row : rows) {
+            final String financialYear = financialYearLabel(((Number) row.get("fy_start")).intValue());
+            final BigDecimal declared = (BigDecimal) row.get("declared_amount");
+            final BigDecimal claimed = (BigDecimal) row.get("claimed_amount");
+            final BigDecimal unclaimed = (BigDecimal) row.get("unclaimed_amount");
+            final BigDecimal forfeited = (BigDecimal) row.get("forfeited_amount");
+            final BigDecimal residue = residueByYear.getOrDefault(financialYear, BigDecimal.ZERO);
+
+            final Map<String, Object> entry = new LinkedHashMap<>();
+            entry.put("financialYear", financialYear);
+            entry.put("declarationCount", row.get("declaration_count"));
+            entry.put("declaredAmount", declared);
+            entry.put("claimedAmount", claimed);
+            entry.put("claimedCount", row.get("claimed_count"));
+            entry.put("unclaimedAmount", unclaimed);
+            entry.put("unclaimedCount", row.get("unclaimed_count"));
+            entry.put("forfeitedAmount", forfeited);
+            entry.put("forfeitedCount", row.get("forfeited_count"));
+            entry.put("roundingResidueAmount", residue);
+            // What has already gone back to profit for this year: forfeited entitlements plus the
+            // rounding residue swept at declaration time.
+            entry.put("returnedToProfitAmount", forfeited.add(residue));
+            // When this year's oldest unclaimed lock forfeits — the date the remaining unclaimed
+            // amount starts returning to profit.
+            entry.put("earliestReleaseDueDate",
+                    row.get("earliest_release_due") == null ? null : String.valueOf(row.get("earliest_release_due")));
+            years.add(entry);
+
+            totalDeclared = totalDeclared.add(declared);
+            totalClaimed = totalClaimed.add(claimed);
+            totalUnclaimed = totalUnclaimed.add(unclaimed);
+            totalForfeited = totalForfeited.add(forfeited);
+        }
+
+        final Map<String, Object> response = new LinkedHashMap<>();
+        response.put("years", years);
+        response.put("totalDeclared", totalDeclared);
+        response.put("totalClaimed", totalClaimed);
+        response.put("totalUnclaimed", totalUnclaimed);
+        response.put("totalForfeited", totalForfeited);
+        return gson.toJson(response);
+    }
+
+    private String financialYearLabel(final int startYear) {
+        return startYear + "-" + String.format("%02d", (startYear + 1) % 100);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/glaccount/validation/GLAccountTransactionGuard.java

@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.glaccount.validation;
+
+import org.apache.fineract.accounting.glaccount.domain.GLAccountUsage;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.springframework.dao.EmptyResultDataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+/**
+ * A Header GL account (account_usage = HEADER) is a pure grouping node in the chart-of-accounts tree - it
+ * exists to organize Detail accounts underneath it, never to receive a transaction itself. The standard
+ * Fineract journal-entry command path (JournalEntryWritePlatformServiceJpaRepositoryImpl) never checked
+ * this - only "disabled" and "manual entries allowed" - and several features in this codebase post journal
+ * entries via direct JDBC INSERT into acc_gl_journal_entry, bypassing that command path entirely. This is
+ * the one shared check every such call site uses so a Header account can never end up with its own
+ * transaction (which would silently break every report that assumes a Header's balance is just the sum of
+ * its Detail children).
+ */
+public final class GLAccountTransactionGuard {
+
+    private GLAccountTransactionGuard() {}
+
+    public static void assertPostable(final JdbcTemplate jdbcTemplate, final Long glAccountId) {
+        if (glAccountId == null) {
+            return;
+        }
+        final Integer usage;
+        try {
+            usage = jdbcTemplate.queryForObject("SELECT account_usage FROM acc_gl_account WHERE id = ?", Integer.class, glAccountId);
+        } catch (final EmptyResultDataAccessException e) {
+            throw new PlatformDataIntegrityException("error.msg.glaccount.not.found",
+                    "GL account with id " + glAccountId + " does not exist.", "glAccountId", glAccountId);
+        }
+        if (GLAccountUsage.HEADER.getValue().equals(usage)) {
+            throw new PlatformDataIntegrityException("error.msg.glaccount.header.account.not.postable",
+                    "GL account " + glAccountId + " is a Header account (a chart-of-accounts grouping node) and cannot receive a "
+                            + "transaction directly. Select a Detail account instead.",
+                    "glAccountId", glAccountId);
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/AccountingProcessorHelper.java

@@ -25,12 +25,14 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import lombok.RequiredArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.accounting.closure.domain.GLClosure;
 import org.apache.fineract.accounting.closure.domain.GLClosureRepository;
 import org.apache.fineract.accounting.common.AccountingConstants;
 import org.apache.fineract.accounting.common.AccountingConstants.AccrualAccountsForLoan;
+import org.apache.fineract.accounting.common.AccountingConstants.AccrualAccountsForSavings;
 import org.apache.fineract.accounting.common.AccountingConstants.CashAccountsForLoan;
 import org.apache.fineract.accounting.common.AccountingConstants.CashAccountsForSavings;
 import org.apache.fineract.accounting.common.AccountingConstants.CashAccountsForShares;
@@ -77,6 +79,7 @@ import org.apache.fineract.portfolio.loanaccount.data.LoanTransactionEnumData;
 import org.apache.fineract.portfolio.savings.data.SavingsAccountTransactionEnumData;
 import org.apache.fineract.portfolio.shareaccounts.data.ShareAccountTransactionEnumData;
 import org.springframework.dao.DataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
 
 @RequiredArgsConstructor
 public class AccountingProcessorHelper {
@@ -89,6 +92,14 @@ public class AccountingProcessorHelper {
     public static final String PROVISIONING_TRANSACTION_IDENTIFIER = "P";
     public static final String SHARE_TRANSACTION_IDENTIFIER = "SH";
 
+    /**
+     * Reserved names on the savings product's Accounting tab, naming the two accounts an interest
+     * posting is routed through. The names are the contract with the product screen; the GL codes
+     * behind them are the bank's choice, so no code is named here.
+     */
+    public static final String SAVINGS_INTEREST_PAYABLE_MAPPING = "Savings Interest Payable";
+    public static final String SAVINGS_INTEREST_PAID_MAPPING = "Savings Interest Paid";
+
     private static final ThreadLocal<Integer> DEPOSIT_ACCOUNT_TYPE_CONTEXT = ThreadLocal.withInitial(() -> 100);
 
     public static void setDepositAccountTypeContext(int depositAccountType) {
@@ -116,6 +127,10 @@ public class AccountingProcessorHelper {
     private final AccountTransfersReadPlatformService accountTransfersReadPlatformService;
     private final ChargeRepositoryWrapper chargeRepositoryWrapper;
     private final BusinessEventNotifierService businessEventNotifierService;
+    // The savings interest payable/paid accounts live in m_savings_product.other_gl_mappings as a
+    // JSON document rather than in acc_product_mapping, so they are read directly. See
+    // namedSavingsGlAccount.
+    private final JdbcTemplate jdbcTemplate;
 
     public LoanDTO populateLoanDtoFromDTO(
             final org.apache.fineract.portfolio.loanaccount.data.AccountingBridgeDataDTO accountingBridgeData) {
@@ -600,6 +615,144 @@ public class AccountingProcessorHelper {
         createCreditJournalEntryForSavings(office, currencyCode, creditAccount, savingsId, transactionId, transactionDate, amount);
     }
 
+    /**
+     * Interest credited to a member, routed through the payable and paid accounts the product names.
+     *
+     * <pre>
+     *   Dr  Interest On Savings        (expense)     the bank incurs the cost
+     *   Cr  Savings Interest Payable   (liability)   and now owes it
+     *
+     *   Dr  Savings Interest Payable
+     *   Cr  Savings Interest Paid                    the debt is on its way out
+     *
+     *   Dr  Savings Interest Paid
+     *   Cr  Savings Control                          and reaches the member
+     * </pre>
+     *
+     * <p>
+     * The two middle accounts net to nil across the three steps, so the trial balance is unchanged
+     * from the plain two-legged entry; what they add is a reading of how much interest has been
+     * declared but not yet credited, which a single Dr/Cr pair cannot show.
+     *
+     * <p>
+     * Both are read from the product's Accounting tab and neither is required. A product that names
+     * no paid account collapses the middle step, and one that names no payable falls back to its own
+     * Savings Control - either way the posting degrades to exactly the two-legged entry it was
+     * before, so products configured before these mappings existed are unaffected.
+     *
+     * <p>
+     * Reversals swap every leg, the same way {@code createCashBasedJournalEntriesAndReversalsForSavings}
+     * does for the two-legged case.
+     */
+    public void createInterestPostingJournalEntriesForSavings(final Office office, final String currencyCode,
+            final Long savingsProductId, final Long paymentTypeId, final Long savingsId, final String transactionId,
+            final LocalDate transactionDate, final BigDecimal amount, final boolean isReversal) {
+
+        final GLAccount controlAccount = getLinkedGLAccountForSavingsProduct(savingsProductId,
+                CashAccountsForSavings.SAVINGS_CONTROL.getValue(), paymentTypeId);
+
+        // The payable comes from the Interest Payable row on the product's Accounting tab, which is
+        // where a bank actually picks it. The reserved name in the product's other GL mappings is
+        // consulted only after that, for a product configured before that row was mapped, and the
+        // Savings Control last of all - interest owed is a liability either way.
+        final GLAccount payableAccount = Optional
+                .ofNullable(optionalLinkedGLAccountForSavingsProduct(savingsProductId,
+                        AccrualAccountsForSavings.INTEREST_PAYABLE.getValue(), paymentTypeId))
+                .or(() -> Optional.ofNullable(namedSavingsGlAccount(savingsProductId, SAVINGS_INTEREST_PAYABLE_MAPPING)))
+                .orElse(controlAccount);
+        final GLAccount paidAccount = Optional.ofNullable(namedSavingsGlAccount(savingsProductId, SAVINGS_INTEREST_PAID_MAPPING))
+                .orElse(payableAccount);
+
+        // The interest expense is not raised here. It is recognised as the interest accrues, day by
+        // day, and this posting settles that recognised debt - raising the expense again at payout
+        // would put the same interest on the P&L twice. This mirrors the pooled posting service,
+        // which pays a product's whole membership the same way; a closure reaching this path must
+        // produce the same entries as the nightly run, or the two disagree on what one payment did.
+        //
+        // Stage 1: the liability moves from the payable to the account it is paid out of. Where the
+        // product names no paid account both resolve to the payable and this says nothing, so it is
+        // skipped and the payout comes straight out of the payable.
+        final boolean payableIsPaid = payableAccount.getId().equals(paidAccount.getId());
+        if (!payableIsPaid) {
+            postSavingsLeg(office, currencyCode, payableAccount, paidAccount, savingsId, transactionId, transactionDate, amount,
+                    isReversal);
+        }
+
+        // Stage 2: into the member's own balance.
+        final GLAccount payoutFromAccount = payableIsPaid ? payableAccount : paidAccount;
+        postSavingsLeg(office, currencyCode, payoutFromAccount, controlAccount, savingsId, transactionId, transactionDate, amount,
+                isReversal);
+    }
+
+    /**
+     * One Dr/Cr pair, with both sides swapped when the transaction is a reversal.
+     *
+     * <p>
+     * A leg whose two sides are the same account writes nothing. That is not a defensive check but
+     * the mechanism by which the three stages above collapse: a product that names no payable and no
+     * paid account resolves all three to its Savings Control, and what should remain is the plain
+     * {@code Dr Interest On Savings / Cr Savings Control} pair Fineract has always posted. Skipping
+     * the middle stage by hand was not enough — stage 3 still resolved to Control against Control and
+     * wrote a pair of entries against one account, which nets to nothing yet leaves the transaction's
+     * debits and credits unequal per account and shows up on the trial balance as movement that never
+     * happened. Deciding it here rather than at each call site means every collapse works the same
+     * way, whichever of the two names a product happens to leave unset.
+     */
+    private void postSavingsLeg(final Office office, final String currencyCode, final GLAccount debitAccount,
+            final GLAccount creditAccount, final Long savingsId, final String transactionId, final LocalDate transactionDate,
+            final BigDecimal amount, final boolean isReversal) {
+        if (debitAccount == null || creditAccount == null || debitAccount.getId().equals(creditAccount.getId())) {
+            return;
+        }
+        final GLAccount toDebit = isReversal ? creditAccount : debitAccount;
+        final GLAccount toCredit = isReversal ? debitAccount : creditAccount;
+        createDebitJournalEntryForSavings(office, currencyCode, toDebit, savingsId, transactionId, transactionDate, amount);
+        createCreditJournalEntryForSavings(office, currencyCode, toCredit, savingsId, transactionId, transactionDate, amount);
+    }
+
+    /**
+     * A GL account the savings product maps under one of the reserved names on its Accounting tab.
+     *
+     * <p>
+     * These live in {@code m_savings_product.other_gl_mappings} as a JSON document of
+     * {@code {assets|liabilities|expenses|income: [{accountName, glCode}]}} rather than in
+     * {@code acc_product_mapping}, because they are named extensions rather than one of Fineract's
+     * fixed financial account types. The name is matched across all four groups: which group a bank
+     * files it under is a presentation choice, and an account configured under the wrong heading
+     * should still be honoured rather than silently ignored.
+     *
+     * @return the account, or null where the product does not configure this name
+     */
+    private GLAccount namedSavingsGlAccount(final Long savingsProductId, final String accountName) {
+        if (savingsProductId == null) {
+            return null;
+        }
+        // The column holds an empty string on a product saved with no named mappings, and casting
+        // that to jsonb is an error rather than an empty document - so the cast is done inside a
+        // subquery that has already filtered those rows out. Postgres is free to evaluate a WHERE
+        // clause in any order, so guarding at the same query level as the cast would only work by
+        // luck.
+        final List<Long> found = jdbcTemplate.queryForList("""
+                SELECT gl.id
+                  FROM (SELECT other_gl_mappings::jsonb AS doc
+                          FROM m_savings_product
+                         WHERE id = ?
+                           AND other_gl_mappings IS NOT NULL
+                           AND other_gl_mappings <> ''
+                           AND other_gl_mappings LIKE '{%') sp
+                  CROSS JOIN LATERAL jsonb_array_elements(
+                         COALESCE(sp.doc -> 'assets',      '[]'::jsonb)
+                      || COALESCE(sp.doc -> 'liabilities', '[]'::jsonb)
+                      || COALESCE(sp.doc -> 'expenses',    '[]'::jsonb)
+                      || COALESCE(sp.doc -> 'income',      '[]'::jsonb)
+                  ) AS m(entry)
+                  JOIN acc_gl_account gl ON gl.gl_code = m.entry ->> 'glCode'
+                 WHERE m.entry ->> 'accountName' = ?
+                 LIMIT 1
+                """, Long.class, savingsProductId, accountName);
+        return found.isEmpty() ? null : glAccountRepository.findById(found.get(0)).orElse(null);
+    }
+
     /**
      * Creates a direct transfer journal entry between two savings-type accounts (savings or current),
      * each with their own product GL mapping and entity ID so the correct account number appears per entry.
@@ -1241,6 +1394,29 @@ public class AccountingProcessorHelper {
         return accountMapping.getGlAccount();
     }
 
+    /**
+     * One row of the savings product's Accounting tab, or null where the bank has not filled it in.
+     *
+     * <p>
+     * Separate from {@link #getLinkedGLAccountForSavingsProduct}, which throws: not every row is
+     * required. Interest Payable is offered on the product screen but a product configured before it
+     * existed has none, and that has to fall through to the next choice rather than stopping the
+     * account from being closed.
+     */
+    private GLAccount optionalLinkedGLAccountForSavingsProduct(final Long savingsProductId, final int accountMappingTypeId,
+            final Long paymentTypeId) {
+        if (savingsProductId == null) {
+            return null;
+        }
+        // Read directly rather than by catching what getLinkedGLAccountForSavingsProduct throws: on a
+        // missing mapping that method builds its message through CashAccountsForSavings.fromInt,
+        // which returns null for a row the cash enum does not carry - Interest Payable among them -
+        // and the lookup would die on a NullPointerException instead of the exception meant for it.
+        final ProductToGLAccountMapping mapping = this.accountMappingRepository.findCoreProductToFinAccountMapping(savingsProductId,
+                PortfolioProductType.SAVING.getValue(), accountMappingTypeId);
+        return mapping == null ? null : mapping.getGlAccount();
+    }
+
     private GLAccount getLinkedGLAccountForSavingsProduct(final Long savingsProductId, final int accountMappingTypeId,
             final Long paymentTypeId) {
         GLAccount glAccount;
@@ -1263,6 +1439,11 @@ public class AccountingProcessorHelper {
                     accountMapping = paymentChannelSpecificAccountMapping;
                 }
             }
+
+            if (accountMapping == null) {
+                throw new ProductToGLAccountMappingNotFoundException(PortfolioProductType.SAVING, savingsProductId,
+                        CashAccountsForSavings.fromInt(accountMappingTypeId).toString());
+            }
             glAccount = accountMapping.getGlAccount();
         }
         return glAccount;
@@ -1287,6 +1468,13 @@ public class AccountingProcessorHelper {
                     accountMapping = paymentChannelSpecificAccountMapping;
                 }
             }
+            // Matches getLinkedGLAccountForSavingsProduct's own guard just above: a share product can
+            // now genuinely have no SHARES_REFERENCE mapping (it stopped being a mandatory field), so
+            // this has to fail with a clean, named error instead of NPEing on accountMapping.
+            if (accountMapping == null) {
+                throw new ProductToGLAccountMappingNotFoundException(PortfolioProductType.SHARES, shareProductId,
+                        CashAccountsForShares.fromInt(accountMappingTypeId).toString());
+            }
             glAccount = accountMapping.getGlAccount();
         }
         return glAccount;

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/CashBasedAccountingProcessorForSavings.java

@@ -170,9 +170,12 @@ public class CashBasedAccountingProcessorForSavings implements AccountingProcess
                 // Post journal entry if earned interest amount is greater than
                 // zero
                 if (savingsTransactionDTO.getAmount().compareTo(BigDecimal.ZERO) > 0) {
-                    this.helper.createCashBasedJournalEntriesAndReversalsForSavings(office, currencyCode,
-                            CashAccountsForSavings.INTEREST_ON_SAVINGS.getValue(), CashAccountsForSavings.SAVINGS_CONTROL.getValue(),
-                            savingsProductId, paymentTypeId, savingsId, transactionId, transactionDate, amount, isReversal);
+                    // Routed through the payable and paid accounts the product names, so the society
+                    // can read interest declared but not yet credited as its own balance. Collapses
+                    // to the plain Dr Interest On Savings / Cr Savings Control pair for a product
+                    // that names neither.
+                    this.helper.createInterestPostingJournalEntriesForSavings(office, currencyCode, savingsProductId, paymentTypeId,
+                            savingsId, transactionId, transactionDate, amount, isReversal);
                 }
             }
 

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/JournalEntryWritePlatformServiceJpaRepositoryImpl.java

@@ -21,9 +21,11 @@ package org.apache.fineract.accounting.journalentry.service;
 import java.math.BigDecimal;
 import java.time.LocalDate;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
+import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -104,6 +106,8 @@ import org.apache.fineract.portfolio.loanaccount.domain.LoanTransactionRepositor
 import org.apache.fineract.portfolio.loanproduct.service.LoanEnumerations;
 import org.apache.fineract.portfolio.paymentdetail.domain.PaymentDetail;
 import org.apache.fineract.portfolio.paymentdetail.service.PaymentDetailWritePlatformService;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
+import org.apache.fineract.portfolio.voucher.service.VoucherService;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.dao.NonTransientDataAccessException;
@@ -136,6 +140,7 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
     private final ExternalAssetOwnerRepository externalAssetOwnerRepository;
     private final LoanAmortizationAllocationMappingRepository loanAmortizationAllocationMappingRepository;
     private final LoanTransactionRepository loanTransactionRepository;
+    private final VoucherService voucherService;
 
     @Transactional
     @Override
@@ -232,14 +237,73 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
 
             }
 
+            // Raise the voucher from the entries that were actually written, rather than from the
+            // command: an accounting rule can supply a side the request never named, so reading
+            // back by transaction id is the only view that matches what the ledger now holds.
+            final String voucherNo = raiseJournalVoucher(transactionId);
+            if (voucherNo != null) {
+                changes.put("voucherNo", voucherNo);
+            }
+
             return new CommandProcessingResultBuilder().withCommandId(command.commandId()).withOfficeId(officeId)
-                    .withTransactionId(transactionId).build();
+                    .withTransactionId(transactionId).with(changes).build();
         } catch (final JpaSystemException | DataIntegrityViolationException dve) {
             final Throwable throwable = dve.getMostSpecificCause();
             throw handleJournalEntryDataIntegrityIssues(throwable, dve);
         }
     }
 
+    /**
+     * Records a manual journal in the voucher register and returns its number.
+     *
+     * The sides are read back from the entries just written rather than taken from the request,
+     * because an accounting rule can contribute a debit or credit the caller never named; only the
+     * persisted rows show what the ledger actually holds.
+     *
+     * A failure here does not fail the journal. The entries are already posted and correct, and
+     * refusing them because the register could not be written would reject a sound accounting
+     * transaction over its paperwork. The problem is logged and the journal stands without a
+     * voucher, which reads as a gap in the register rather than as a missing ledger entry.
+     */
+    private String raiseJournalVoucher(final String transactionId) {
+        // A register that posts its ledger movement through this command raises its own voucher,
+        // naming the member and the instrument. Raising a journal one beside it would put the same
+        // money in the register twice.
+        if (!this.voucherService.shouldRaiseVoucher()) {
+            return null;
+        }
+
+        try {
+            final List<JournalEntry> entries = this.glJournalEntryRepository
+                    .findUnReversedManualJournalEntriesByTransactionId(transactionId);
+            if (CollectionUtils.isEmpty(entries)) {
+                return null;
+            }
+
+            final List<VoucherLine> lines = new ArrayList<>();
+            for (final JournalEntry entry : entries) {
+                final GLAccount account = entry.getGlAccount();
+                final Long accountId = account == null ? null : account.getId();
+                final String name = account == null ? null : account.getName();
+                final String code = account == null ? null : account.getGlCode();
+
+                final VoucherLine line = entry.isDebitEntry() ? VoucherLine.debitGl(accountId, name, code, entry.getAmount())
+                        : VoucherLine.creditGl(accountId, name, code, entry.getAmount());
+                lines.add(entry.getDescription() == null ? line : line.withDescription(entry.getDescription()));
+            }
+
+            // Debits first, so the voucher prints the way a slip is read.
+            lines.sort(Comparator.comparing(VoucherLine::isDebit).reversed());
+
+            final AppUser currentUser = this.context.authenticatedUser();
+            return this.voucherService.createVoucherWithLines(VoucherService.TYPE_JOURNAL, VoucherService.REF_JOURNAL_ENTRY, null,
+                    transactionId, currentUser, VoucherService.PREFIX_JOURNAL, lines);
+        } catch (final RuntimeException e) {
+            log.error("Could not raise a voucher for journal transaction {}", transactionId, e);
+            return null;
+        }
+    }
+
     private void validateDebitOrCreditArrayForExistingGLAccount(final GLAccount glaccount,
             final SingleDebitOrCreditEntryCommand[] creditOrDebits) {
         /**
@@ -328,6 +392,9 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
         } else if (!creditOrDebitAccountHead.isManualEntriesAllowed()) {
             throw new JournalEntryInvalidException(GlJournalEntryInvalidReason.GL_ACCOUNT_MANUAL_ENTRIES_NOT_PERMITTED, null,
                     creditOrDebitAccountHead.getName(), creditOrDebitAccountHead.getGlCode());
+        } else if (creditOrDebitAccountHead.isHeaderAccount()) {
+            throw new JournalEntryInvalidException(GlJournalEntryInvalidReason.GL_ACCOUNT_IS_HEADER, null,
+                    creditOrDebitAccountHead.getName(), creditOrDebitAccountHead.getGlCode());
         }
     }
 
@@ -564,7 +631,12 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
         final boolean cashBasedAccountingEnabled = (Boolean) accountingBridgeData.get("cashBasedAccountingEnabled");
         final boolean accrualBasedAccountingEnabled = (Boolean) accountingBridgeData.get("accrualBasedAccountingEnabled");
 
-        if (cashBasedAccountingEnabled) {
+        // A register that knows the transaction's real counterparty posts the entry itself, in one
+        // balanced pair against that account, and says so by wrapping the command in
+        // ShareAccountingSuppression.withOwnShareEntries(). Posting here as well would add a second
+        // entry for the same money, booked against the product's fixed Shares Reference account --
+        // which is what that register is avoiding in the first place.
+        if (cashBasedAccountingEnabled && ShareAccountingSuppression.shouldPostShareEntries()) {
             final SharesDTO sharesDTO = this.helper.populateSharesDtoFromMap(accountingBridgeData, cashBasedAccountingEnabled,
                     accrualBasedAccountingEnabled);
             final AccountingProcessorForShares accountingProcessorForShares = this.accountingProcessorForSharesFactory
@@ -712,15 +784,30 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
             final String currencyCode = command.stringValueOfParameterNamed(JournalEntryJsonInputParams.CURRENCY_CODE.getValue());
 
             validateBusinessRulesForJournalEntries(journalEntryCommand);
+            validateNoDenominationManagedCashAccounts(journalEntryCommand);
 
             /**
              * revert old journal entries
+             *
+             * A transaction that carries a leg against the denomination-managed cash account (see
+             * validateNoDenominationManagedCashAccounts) is skipped here rather than reversed: it is
+             * tied to this same office+contra pairing (Migrate Cash Denomination posts its opening
+             * entry against this same Opening Balances Contra account), so the query above finds it
+             * too. Reversing it here, while the new submission is barred from ever re-posting a cash
+             * leg, would silently erase the cash account's opening balance every time an admin
+             * redefines opening balances for any OTHER account at this office.
              */
+            final List<Long> denominationManagedGlAccountIds = resolveDenominationManagedCashGlAccountIds();
             final List<String> transactionIdsToBeReversed = this.glJournalEntryRepository.findNonReversedContraTransactionIds(contraId,
                     officeId);
             for (String transactionId : transactionIdsToBeReversed) {
                 final List<JournalEntry> journalEntries = this.glJournalEntryRepository
                         .findUnReversedManualJournalEntriesByTransactionId(transactionId);
+                final boolean touchesDenominationManagedCashAccount = journalEntries.stream()
+                        .anyMatch(je -> je.getGlAccount() != null && denominationManagedGlAccountIds.contains(je.getGlAccount().getId()));
+                if (touchesDenominationManagedCashAccount) {
+                    continue;
+                }
                 revertJournalEntry(journalEntries, "defining opening balance");
             }
 
@@ -802,6 +889,55 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
         }
     }
 
+    /**
+     * The GL account(s) Financial Activity 101 (Cash at Vault) / 102 (Cash at Teller) map to. Shared
+     * by the validation below and by defineOpeningBalance's own revert step, so both agree on exactly
+     * which account(s) Migrate Cash Denomination owns.
+     */
+    private List<Long> resolveDenominationManagedCashGlAccountIds() {
+        final List<Long> ids = new ArrayList<>();
+        for (final FinancialActivityAccount mapping : this.financialActivityAccountRepositoryWrapper.findAll()) {
+            final Integer type = mapping.getFinancialActivityType();
+            if ((type != null && (type == 101 || type == 102)) && mapping.getGlAccount() != null) {
+                ids.add(mapping.getGlAccount().getId());
+            }
+        }
+        return ids;
+    }
+
+    /**
+     * The GL account(s) mapped to Financial Activity 101 (Cash at Vault) / 102 (Cash at Teller) are
+     * managed exclusively through Migrate Cash Denomination (BranchDayRegisterApiResource#migrateCashDenomination),
+     * which keeps the GL figure tied to an actual counted note-and-coin breakdown, and validates any
+     * redefinition against that same count. Defining or redefining that account's opening balance here
+     * instead - as a bare number, with no denomination breakdown behind it - would let the GL figure
+     * drift away from what is physically in the till, with nothing left to catch the mismatch. So this
+     * command refuses to touch either of those accounts at all, on either side of the entry, rather than
+     * only when the amount would differ from what is already posted: the physical count is the only
+     * source of truth for this account, never a number typed into a generic opening-balance grid.
+     */
+    private void validateNoDenominationManagedCashAccounts(final JournalEntryCommand command) {
+        final List<Long> denominationManagedGlAccountIds = resolveDenominationManagedCashGlAccountIds();
+        if (denominationManagedGlAccountIds.isEmpty()) {
+            return;
+        }
+        final List<SingleDebitOrCreditEntryCommand> allEntries = new ArrayList<>();
+        if (command.getDebits() != null) {
+            allEntries.addAll(Arrays.asList(command.getDebits()));
+        }
+        if (command.getCredits() != null) {
+            allEntries.addAll(Arrays.asList(command.getCredits()));
+        }
+        for (final SingleDebitOrCreditEntryCommand entry : allEntries) {
+            if (denominationManagedGlAccountIds.contains(entry.getGlAccountId())) {
+                throw new GeneralPlatformDomainRuleException("error.msg.journalentry.opening.balance.cash.account.locked",
+                        "This account is the tenant's Cash at Vault / Cash at Teller account and is managed through "
+                                + "Migrate Cash Denomination - it cannot be set or changed from Migrate Opening Balances.",
+                        entry.getGlAccountId());
+            }
+        }
+    }
+
     @Override
     public void createJournalEntriesForClientTransactions(Map<String, Object> accountingBridgeData) {
         final ClientTransactionDTO clientTransactionDTO = this.helper.populateClientTransactionDtoFromMap(accountingBridgeData);

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/LedgerTransactionId.java

@@ -0,0 +1,157 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.journalentry.service;
+
+import java.sql.Date;
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+/**
+ * Mints the transaction id that ties the rows of one posting together in acc_gl_journal_entry.
+ *
+ * <p>
+ * Every feature here that posts a journal entry by direct JDBC used to invent this id by hand, and the two
+ * shapes that emerged were each wrong in their own way. Some concatenated a business row's own primary key
+ * ({@code "DIVROUND" + dividendPayOutId}); a primary key is only unique while its sequence keeps climbing,
+ * so a reset hands the same number out twice - which is exactly how two unrelated share withdrawals came to
+ * share one transaction id and render as a single doubled voucher. Others concatenated
+ * {@code System.nanoTime()}, which is unique but says nothing to whoever reads it off a screen
+ * ({@code "CASHMIG-1-20260913-923935527932300"}).
+ *
+ * <p>
+ * This generator replaces both with one readable shape, {@code PREFIX-YYMMDD-NNNN}:
+ *
+ * <pre>
+ *   SHWGL-260916-0001   the first share-withdrawal GL settlement posted on 16 Sep 2026
+ *   DIVRND-260916-0007  the seventh dividend rounding posted that day
+ * </pre>
+ *
+ * The prefix names the event, the date is the tenant's business date, and the serial restarts at 0001 each
+ * day. That makes a transaction id self-describing: a reader can tell what it was and when it happened
+ * without looking anything up.
+ *
+ * <p>
+ * Uniqueness does not depend on any business table. The serial comes from {@code m_ledger_txn_sequence}, a
+ * counter that belongs to no entity, so no entity's sequence can make it repeat. The counter is bumped by a
+ * single {@code INSERT ... ON CONFLICT DO UPDATE}, which takes and releases the row lock atomically, so two
+ * users posting at the same instant are serialised by the database rather than handed the same number - the
+ * same mechanism {@code m_voucher_sequence} already uses for voucher numbers.
+ *
+ * <p>
+ * The counter alone would still repeat if that table were ever truncated or rewound by hand, which is
+ * precisely the accident being defended against, so the minted id is also checked against the ledger before
+ * being handed back and the counter is advanced past anything already in use. That makes a duplicate
+ * impossible by construction rather than by convention: the id is only returned once no row holds it.
+ *
+ * <p>
+ * Ids already in the ledger keep their old shape. Nothing reconstructs a custom id to find its rows again
+ * (every call site mints one, posts with it, and never derives it a second time), so old and new shapes
+ * coexist without anything needing to read both.
+ *
+ * <p>
+ * Postings made by Fineract's own command path are not covered here and keep their native
+ * {@code "S"/"L"/"SH"/"C" + transaction id} form, which {@code AccountingProcessorHelper} derives and
+ * several readers reconstruct. Those readers are hardened at the query instead, by resolving to the most
+ * recently posted rows rather than assuming the text is unique.
+ */
+public final class LedgerTransactionId {
+
+    /** Guards against an impossible-in-practice runaway if the ledger and the counter disagree. */
+    private static final int MAX_PROBES = 50;
+
+    private static final DateTimeFormatter YYMMDD = DateTimeFormatter.ofPattern("yyMMdd");
+
+    private LedgerTransactionId() {}
+
+    /**
+     * Returns the next transaction id for this kind of posting, e.g. {@code SHWGL-260916-0001}.
+     *
+     * @param prefix
+     *            short uppercase code naming the event, from {@link LedgerTxnPrefix}
+     */
+    public static String next(final JdbcTemplate jdbcTemplate, final String prefix) {
+        // Tenant timezone, not the server's - the day the counter resets on has to be the branch's
+        // business day, otherwise a late-evening posting lands in the wrong series.
+        final LocalDate today = LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
+        final String datePart = today.format(YYMMDD);
+
+        for (int probe = 0; probe < MAX_PROBES; probe++) {
+            final int serial = nextSerial(jdbcTemplate, prefix, today);
+            final String candidate = String.format("%s-%s-%04d", prefix, datePart, serial);
+            if (!isTaken(jdbcTemplate, candidate)) {
+                return candidate;
+            }
+            // Only reachable if the counter was rewound behind the ledger by hand. Bumping again walks
+            // it forward until it clears whatever is already posted, which self-heals the counter.
+        }
+        throw new IllegalStateException("Could not mint a free ledger transaction id for prefix " + prefix + " after " + MAX_PROBES
+                + " attempts. The m_ledger_txn_sequence counter for this prefix is far behind the entries already posted today.");
+    }
+
+    /**
+     * Returns the id for a posting that has to be reproducible, e.g. {@code SAVINT-260916-P0002}.
+     *
+     * <p>
+     * Some postings are not one-shot: a pooled interest run pays hundreds of members, and a run that
+     * stops halfway is resumed rather than restarted. Those resumed legs belong to the posting that
+     * started them, so the id has to come out the same on the second pass - a counter would hand the
+     * remainder a different id and split one posting across two transactions. This builds the id from
+     * what identifies the run instead: the same prefix, date and discriminator always produce the same
+     * string, and no counter is consumed.
+     *
+     * <p>
+     * Uniqueness rests on the caller's own discriminator being unique for that prefix and date (the
+     * product being posted, say), which is what makes the id reproducible in the first place. Use
+     * {@link #next} for everything else - a posting that happens once wants a counter, not a formula.
+     * The {@code P} marks the tail as a discriminator so it is not misread as a serial.
+     *
+     * @param date
+     *            the date the posting belongs to, which is not always today - interest can be posted
+     *            for an earlier day
+     * @param discriminator
+     *            what makes this run distinct from another on the same date, e.g. the product id
+     */
+    public static String forDatedSeries(final String prefix, final LocalDate date, final long discriminator) {
+        return String.format("%s-%s-P%04d", prefix, date.format(YYMMDD), discriminator);
+    }
+
+    /**
+     * Reserves the next counter value for one (prefix, day) series.
+     *
+     * The INSERT ... ON CONFLICT DO UPDATE both creates the series on its first use of the day and
+     * increments it thereafter. Being a single statement it is atomic, so no explicit lock is needed.
+     */
+    private static int nextSerial(final JdbcTemplate jdbcTemplate, final String prefix, final LocalDate day) {
+        return jdbcTemplate.queryForObject("""
+                INSERT INTO m_ledger_txn_sequence (prefix, series_date, last_number)
+                VALUES (?,?,1)
+                ON CONFLICT (prefix, series_date)
+                DO UPDATE SET last_number = m_ledger_txn_sequence.last_number + 1
+                RETURNING last_number
+                """, Integer.class, prefix, Date.valueOf(day));
+    }
+
+    private static boolean isTaken(final JdbcTemplate jdbcTemplate, final String transactionId) {
+        final Boolean taken = jdbcTemplate.queryForObject("SELECT EXISTS (SELECT 1 FROM acc_gl_journal_entry WHERE transaction_id = ?)",
+                Boolean.class, transactionId);
+        return Boolean.TRUE.equals(taken);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/LedgerTxnPrefix.java

@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.journalentry.service;
+
+/**
+ * The event codes that open a transaction id minted by {@link LedgerTransactionId}.
+ *
+ * <p>
+ * They live together in one place so a reader can decode any transaction id on a screen from a single list,
+ * and so no two features can drift into naming the same event differently - which had already happened:
+ * dividend forfeiture was posting under {@code DIVFORF} from one service and {@code DIVFORFEIT} from
+ * another, for the same event.
+ *
+ * <p>
+ * Codes are uppercase, up to eight characters, and grouped by the module that raises them. A code is part of
+ * the audit trail once it has been posted, so treat these as append-only: add a new one for a new event
+ * rather than renaming an existing one, which would leave already-posted entries speaking a language nothing
+ * else uses any more.
+ */
+public final class LedgerTxnPrefix {
+
+    private LedgerTxnPrefix() {}
+
+    // A clerk's share withdrawal has no code here on purpose: it posts under the transaction id the
+    // native redeem command already minted ("SH" + share transaction id), because its debit leg is
+    // that command's own and the two have to group as one balanced entry.
+
+    // ── Share tranche funding ─────────────────────────────────────────────────
+    /** Additional share tranche: reversal of the stock reference posting. */
+    public static final String SHARE_TRANCHE_REFERENCE = "SHTREF";
+    /** Additional share tranche funded from the member's savings account. */
+    public static final String SHARE_TRANCHE_SAVINGS = "SHTSAV";
+
+    // ── Share collection and advances ─────────────────────────────────────────
+    /** Share application money collected. */
+    public static final String SHARE_COLLECTION = "SHCOL";
+    /** Share advance collected against a future allotment. */
+    public static final String SHARE_ADVANCE = "SHADV";
+    /** Share advance applied to an allotment. */
+    public static final String SHARE_ADVANCE_APPLIED = "SHAPP";
+
+    // ── Dividend ──────────────────────────────────────────────────────────────
+    /** Dividend claim paid out to a member. */
+    public static final String DIVIDEND_CLAIM = "DIVCLM";
+    /** Dividend declaration posted. */
+    public static final String DIVIDEND_DECLARED = "DIVDCL";
+    /** Dividend declaration approved. */
+    public static final String DIVIDEND_APPROVED = "DIVAPR";
+    /** Dividend payout closed off. */
+    public static final String DIVIDEND_CLOSED = "DIVCLS";
+    /** Rounding difference on a dividend payout. */
+    public static final String DIVIDEND_ROUNDING = "DIVRND";
+    /** Unclaimed dividend forfeited. */
+    public static final String DIVIDEND_FORFEIT = "DIVFRF";
+
+    // ── Branch day and cash ───────────────────────────────────────────────────
+    /** Opening cash migrated into the branch day register. */
+    public static final String CASH_MIGRATION = "CSHMIG";
+    /** Rounding difference on a clerk's day closure. */
+    public static final String CLOSURE_ROUNDING = "CLSRND";
+
+    // ── Year end ──────────────────────────────────────────────────────────────
+    /** Year-end transfer of income into the profit account. */
+    public static final String YEAR_END_PROFIT = "YEPFT";
+    /** Year-end closure of an income or expense account. */
+    public static final String YEAR_END_CLOSE = "YECLS";
+
+    // ── Savings ───────────────────────────────────────────────────────────────
+    /** Pooled savings interest posting for one product and date. */
+    public static final String SAVINGS_INTEREST_POOLED = "SAVINT";
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/ShareAccountingSuppression.java

@@ -0,0 +1,83 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.journalentry.service;
+
+import java.util.function.Supplier;
+
+/**
+ * Lets a register that posts a share transaction's accounting itself tell the platform not to post its
+ * own.
+ *
+ * <h3>Why this exists</h3>
+ *
+ * <p>
+ * Fineract books every share transaction against a fixed "Shares Reference" account taken from the
+ * product's GL mapping: a redemption posts Dr Shares Equity / Cr Shares Reference, whatever the money
+ * actually did. That account is a placeholder for a counterparty the platform does not know, and in a
+ * real core banking ledger there is no such thing — a redemption paid in cash credits the cash
+ * account, and one settled by transfer credits the account it was transferred to. Naming a single
+ * asset account for both leaves every redemption sitting against a GL the money never touched, which
+ * then has to be corrected by hand.
+ *
+ * <p>
+ * The governed clerk registers already know the real counterparty, because the clerk keyed it: the
+ * linked savings account, or the GL picked on the transfer's credit row. They post the redemption
+ * themselves, correctly, in one balanced entry. Before this flag existed they had to let the platform
+ * post its version first and then reverse the half that was wrong, which left a dead Cr Shares
+ * Reference row behind on every redemption and made the ledger read as though cash had moved.
+ *
+ * <h3>Why a flag and not the product's accounting rule</h3>
+ *
+ * <p>
+ * Turning the share product's accounting off entirely ({@code m_share_product.accounting_type = NONE})
+ * would silence the platform everywhere, including the share account screen's own Redeem action, which
+ * no register covers — those redemptions would post nothing at all and go unnoticed, because that
+ * branch fails silently by design. Scoping the suppression to the one call that is about to post its
+ * own entry leaves every other path exactly as it is.
+ *
+ * <p>
+ * A ThreadLocal rather than a request attribute, and restoring the previous value rather than clearing
+ * it, for the same reasons as {@code VoucherService.withOwnVoucher} — a batch job has no request to
+ * hang the flag on, and nesting must not switch the suppression off early for an outer caller.
+ */
+public final class ShareAccountingSuppression {
+
+    private static final ThreadLocal<Boolean> CALLER_POSTS_SHARE_ENTRIES = ThreadLocal.withInitial(() -> Boolean.FALSE);
+
+    private ShareAccountingSuppression() {}
+
+    /**
+     * Runs {@code command} with the platform's own share journal entries suppressed, for a caller that
+     * posts the transaction's accounting itself.
+     */
+    public static <T> T withOwnShareEntries(final Supplier<T> command) {
+        final boolean previous = CALLER_POSTS_SHARE_ENTRIES.get();
+        CALLER_POSTS_SHARE_ENTRIES.set(Boolean.TRUE);
+        try {
+            return command.get();
+        } finally {
+            CALLER_POSTS_SHARE_ENTRIES.set(previous);
+        }
+    }
+
+    /** False only while a caller inside {@link #withOwnShareEntries} is posting its own entries. */
+    public static boolean shouldPostShareEntries() {
+        return !CALLER_POSTS_SHARE_ENTRIES.get();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/starter/AccountingJournalEntryConfiguration.java

@@ -52,6 +52,7 @@ import org.apache.fineract.portfolio.charge.domain.ChargeRepositoryWrapper;
 import org.apache.fineract.portfolio.loanaccount.domain.LoanAmortizationAllocationMappingRepository;
 import org.apache.fineract.portfolio.loanaccount.domain.LoanTransactionRepository;
 import org.apache.fineract.portfolio.paymentdetail.service.PaymentDetailWritePlatformService;
+import org.apache.fineract.portfolio.voucher.service.VoucherService;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -67,10 +68,10 @@ public class AccountingJournalEntryConfiguration {
             FinancialActivityAccountRepositoryWrapper financialActivityAccountRepository, GLClosureRepository closureRepository,
             GLAccountRepository glAccountRepository, OfficeRepository officeRepository,
             AccountTransfersReadPlatformService accountTransfersReadPlatformService, ChargeRepositoryWrapper chargeRepositoryWrapper,
-            BusinessEventNotifierService businessEventNotifierService) {
+            BusinessEventNotifierService businessEventNotifierService, JdbcTemplate jdbcTemplate) {
         return new AccountingProcessorHelper(glJournalEntryRepository, accountMappingRepository, financialActivityAccountRepository,
                 closureRepository, glAccountRepository, officeRepository, accountTransfersReadPlatformService, chargeRepositoryWrapper,
-                businessEventNotifierService);
+                businessEventNotifierService, jdbcTemplate);
     }
 
     @Bean
@@ -98,12 +99,13 @@ public class AccountingJournalEntryConfiguration {
             ConfigurationReadPlatformService configurationReadPlatformService, AccountingService accountingService,
             ExternalAssetOwnerRepository externalAssetOwnerRepository,
             LoanAmortizationAllocationMappingRepository loanAmortizationAllocationMappingRepository,
-            LoanTransactionRepository loanTransactionRepository) {
+            LoanTransactionRepository loanTransactionRepository, VoucherService voucherService) {
         return new JournalEntryWritePlatformServiceJpaRepositoryImpl(glClosureRepository, glAccountRepository, glJournalEntryRepository,
                 officeRepositoryWrapper, accountingProcessorForLoanFactory, accountingProcessorForSavingsFactory,
                 accountingProcessorForSharesFactory, helper, fromApiJsonDeserializer, accountingRuleRepository,
                 glAccountReadPlatformService, organisationCurrencyRepository, context, paymentDetailWritePlatformService,
                 financialActivityAccountRepositoryWrapper, accountingProcessorForClientTransactions, configurationReadPlatformService,
-                accountingService, externalAssetOwnerRepository, loanAmortizationAllocationMappingRepository, loanTransactionRepository);
+                accountingService, externalAssetOwnerRepository, loanAmortizationAllocationMappingRepository, loanTransactionRepository,
+                voucherService);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/accounting/productaccountmapping/service/ProductToGLAccountMappingWritePlatformServiceImpl.java

@@ -301,6 +301,15 @@ public class ProductToGLAccountMappingWritePlatformServiceImpl implements Produc
                     CashAccountsForSavings.ESCHEAT_LIABILITY.getValue());
         }
 
+        // Optional: only mapped when the product screen supplies it. Every savings product that
+        // existed before this row was added has none, and a closure on one of those still has to
+        // work — see the closure's own fallback.
+        if (this.fromApiJsonHelper.parameterExists(SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(), element)) {
+            this.savingsProductToGLAccountMappingHelper.saveSavingsToExpenseAccountMapping(element,
+                    SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(), savingProductId,
+                    CashAccountsForSavings.ROUNDING_ADJUSTMENT.getValue());
+        }
+
         // advanced accounting mappings
         this.savingsProductToGLAccountMappingHelper.savePaymentChannelToFundSourceMappings(command, element, savingProductId, null);
         this.savingsProductToGLAccountMappingHelper.saveChargesToIncomeAccountMappings(command, element, savingProductId, null);

fineract-provider/src/main/java/org/apache/fineract/accounting/profitandloss/api/DistributableProfitApiResource.java

@@ -0,0 +1,264 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.profitandloss.api;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.sql.Date;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.accounting.common.DividendGlAccountResolver;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * How much profit is available to fund a share dividend, for a given period.
+ *
+ * This is not what sizes a dividend — that is the declared rate on members' paid-up capital. It is what the society has
+ * to pay it with: the profit standing in the Bank Profit (Non-Distributable) GL, less every dividend already declared
+ * for another share product over the same period, since they all draw on the same balance.
+ *
+ * The statutory reserve and education fund are not deducted here. They are appropriated on the profit-distribution
+ * screen before any dividend is declared, so the balance this reads has already had them taken out; deducting them a
+ * second time would hold back money that has already left the account.
+ *
+ * Held in one place so the declaration screen and the declaration-time validation cannot disagree about the ceiling.
+ */
+@Path("/v1/accounting/distributable-profit")
+@Component
+@Tag(name = "Distributable Profit", description = "Profit available to fund a share dividend, less dividends already declared against the same period.")
+@RequiredArgsConstructor
+public class DistributableProfitApiResource {
+
+    /**
+     * The year's closed-out profit, which is what a dividend may be declared against.
+     *
+     * Deliberately not Retained Profit — that holds what earlier declarations left behind, and reading it here would
+     * offer profit already distributed once for distribution again.
+     */
+    private final DividendGlAccountResolver dividendGlAccounts;
+
+    private static final String CONFIG_MAXIMUM_RATE = "dividend-maximum-rate-percentage";
+
+    private final JdbcTemplate jdbcTemplate;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public String getDistributableProfit(@QueryParam("fromDate") final String fromDate, @QueryParam("toDate") final String toDate,
+            @QueryParam("excludeProductId") final Long excludeProductId) {
+        if (fromDate == null || fromDate.isBlank() || toDate == null || toDate.isBlank()) {
+            throw apiError(400, "fromDate and toDate (yyyy-MM-dd) are both required");
+        }
+        final Date from;
+        final Date to;
+        try {
+            from = Date.valueOf(fromDate);
+            to = Date.valueOf(toDate);
+        } catch (final IllegalArgumentException e) {
+            throw apiError(400, "fromDate and toDate must be in yyyy-MM-dd format");
+        }
+        if (to.before(from)) {
+            throw apiError(400, "toDate must not be before fromDate");
+        }
+
+        // A dividend is normally declared for a whole, closed financial year, and then the audited
+        // profit in Bank Profit is the figure to use. A period that is not a full financial year can
+        // only be an interim declaration, which necessarily runs against the still-open P&L.
+        final String financialYear = financialYearOf(from.toLocalDate());
+        final LocalDate[] fyRange = financialYearRange(financialYear);
+        final boolean coversWholeFinancialYear = !from.toLocalDate().isAfter(fyRange[0]) && !to.toLocalDate().isBefore(fyRange[1]);
+
+        final BigDecimal closedProfit = coversWholeFinancialYear ? closedProfitForFinancialYear(financialYear) : null;
+        final boolean yearClosed = closedProfit != null;
+        final BigDecimal netProfit = yearClosed ? closedProfit : netProfitForPeriod(from, to);
+
+        final BigDecimal maximumRatePercentage = configuredPercentage(CONFIG_MAXIMUM_RATE);
+
+        // The statutory reserve and education fund are NOT deducted here. They are appropriated on
+        // the profit-distribution screen before any dividend is declared, so the profit this reads
+        // has already had them taken out — subtracting them again would hold back money that is no
+        // longer in the account. A loss-making period funds nothing, so it collapses to zero rather
+        // than a negative figure a caller could read as a credit.
+        final BigDecimal distributableProfit = netProfit.signum() > 0 ? netProfit : BigDecimal.ZERO;
+
+        final List<Map<String, Object>> existingDeclarations = declarationsOverlapping(from, to, excludeProductId);
+        BigDecimal alreadyDeclared = BigDecimal.ZERO;
+        for (final Map<String, Object> declaration : existingDeclarations) {
+            alreadyDeclared = alreadyDeclared.add((BigDecimal) declaration.get("amount"));
+        }
+
+        // An over-declaration that already happened (or appropriation rates raised after the fact)
+        // must not present as negative headroom, which a caller could read as a credit.
+        final BigDecimal availableForDeclaration = distributableProfit.subtract(alreadyDeclared).max(BigDecimal.ZERO);
+
+        final Map<String, Object> response = new LinkedHashMap<>();
+        response.put("fromDate", fromDate);
+        response.put("toDate", toDate);
+        response.put("financialYear", financialYear);
+        response.put("coversWholeFinancialYear", coversWholeFinancialYear);
+        response.put("yearClosed", yearClosed);
+        // Names the figure so the screen can say where it came from — the closed books, or a P&L
+        // that is still moving — rather than showing a bare number the officer has to interpret.
+        response.put("profitSource", yearClosed ? "BANK_PROFIT_GL" : "OPEN_PROFIT_AND_LOSS");
+        response.put("netProfit", netProfit);
+        response.put("distributableProfit", distributableProfit);
+        response.put("alreadyDeclared", alreadyDeclared);
+        response.put("availableForDeclaration", availableForDeclaration);
+        response.put("maximumRatePercentage", maximumRatePercentage);
+        response.put("existingDeclarations", existingDeclarations);
+        return gson.toJson(response);
+    }
+
+    /**
+     * The year's profit as the books actually record it, once the year has been closed.
+     *
+     * A dividend is declared out of the AUDITED profit of a completed financial year, and that figure lives in the
+     * Bank Profit equity GL after year-end closing moves every income and expense GL into it. Reading it here — rather
+     * than re-deriving income-less-expense — means the dividend can never disagree with the closed books: if a
+     * closing entry was adjusted, reversed, or posted late, the dividend ceiling moves with it.
+     *
+     * Returns null when the year has not been closed, which the caller reports as a blocking condition rather than
+     * silently falling back to the live P&L. Distributing against an unclosed year would be distributing a profit
+     * figure that is still moving.
+     */
+    private BigDecimal closedProfitForFinancialYear(final String financialYear) {
+        final Integer closedCount = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_income_profit_transfer WHERE financial_year = ?", Integer.class, financialYear);
+        if (closedCount == null || closedCount == 0) {
+            return null;
+        }
+        final LocalDate[] range = financialYearRange(financialYear);
+        final BigDecimal balance = jdbcTemplate.queryForObject("""
+                SELECT COALESCE(SUM(CASE WHEN je.type_enum = 1 THEN je.amount ELSE -je.amount END), 0)
+                FROM acc_gl_journal_entry je
+                WHERE je.account_id = ? AND je.reversed = false AND je.entry_date BETWEEN ? AND ?
+                """, BigDecimal.class, dividendGlAccounts.distributableProfitAccount(), java.sql.Date.valueOf(range[0]),
+                java.sql.Date.valueOf(range[1]));
+        return balance == null ? BigDecimal.ZERO : balance;
+    }
+
+    /** "2026-27" -> 1 April 2026 to 31 March 2027. */
+    private LocalDate[] financialYearRange(final String financialYear) {
+        try {
+            final int startYear = Integer.parseInt(financialYear.substring(0, 4));
+            return new LocalDate[] { LocalDate.of(startYear, 4, 1), LocalDate.of(startYear + 1, 3, 31) };
+        } catch (final RuntimeException e) {
+            throw apiError(400, "financialYear must look like 2026-27. Received: " + financialYear);
+        }
+    }
+
+    /** The Indian financial year a date falls in, as a "YYYY-YY" label. */
+    private String financialYearOf(final LocalDate date) {
+        final int startYear = date.getMonthValue() >= 4 ? date.getYear() : date.getYear() - 1;
+        return startYear + "-" + String.format("%02d", (startYear + 1) % 100);
+    }
+
+    /**
+     * Same income-less-expense computation as {@link ProfitAndLossApiResource}, over posted, non-reversed journal
+     * entries only. Used only for the interim case — a period inside a year that has not been closed yet.
+     */
+    private BigDecimal netProfitForPeriod(final Date from, final Date to) {
+        final Map<String, Object> row = jdbcTemplate.queryForMap("""
+                SELECT
+                    COALESCE(SUM(CASE WHEN a.classification_enum = 4 AND je.type_enum = 1 THEN je.amount
+                                       WHEN a.classification_enum = 4 AND je.type_enum = 2 THEN -je.amount
+                                       ELSE 0 END), 0) AS total_income,
+                    COALESCE(SUM(CASE WHEN a.classification_enum = 5 AND je.type_enum = 2 THEN je.amount
+                                       WHEN a.classification_enum = 5 AND je.type_enum = 1 THEN -je.amount
+                                       ELSE 0 END), 0) AS total_expense
+                FROM acc_gl_journal_entry je
+                JOIN acc_gl_account a ON a.id = je.account_id
+                WHERE je.reversed = false
+                  AND je.entry_date BETWEEN ? AND ?
+                """, from, to);
+        final BigDecimal totalIncome = (BigDecimal) row.get("total_income");
+        final BigDecimal totalExpense = (BigDecimal) row.get("total_expense");
+        return totalIncome.subtract(totalExpense);
+    }
+
+    /**
+     * Every dividend already declared against a period overlapping this one, across ALL share products — the profit is
+     * society-wide, so a second product's declaration competes for the same balance as the first.
+     *
+     * excludeProductId lets the declaration screen leave out the product being declared for, whose own overlapping
+     * declaration is separately blocked outright.
+     */
+    private List<Map<String, Object>> declarationsOverlapping(final Date from, final Date to, final Long excludeProductId) {
+        final StringBuilder sql = new StringBuilder("""
+                SELECT d.id AS declaration_id, d.product_id, p.name AS product_name, d.amount,
+                       d.dividend_period_start_date, d.dividend_period_end_date, d.status
+                FROM m_share_product_dividend_pay_out d
+                JOIN m_share_product p ON p.id = d.product_id
+                WHERE d.dividend_period_start_date <= ? AND d.dividend_period_end_date >= ?
+                """);
+        final List<Object> params = new ArrayList<>(List.of(to, from));
+        if (excludeProductId != null) {
+            sql.append(" AND d.product_id <> ? ");
+            params.add(excludeProductId);
+        }
+        sql.append(" ORDER BY d.dividend_period_start_date, d.id");
+
+        final List<Map<String, Object>> declarations = new ArrayList<>();
+        for (final Map<String, Object> row : jdbcTemplate.queryForList(sql.toString(), params.toArray())) {
+            final Map<String, Object> declaration = new LinkedHashMap<>();
+            declaration.put("declarationId", row.get("declaration_id"));
+            declaration.put("productId", row.get("product_id"));
+            declaration.put("productName", row.get("product_name"));
+            declaration.put("amount", row.get("amount"));
+            declaration.put("periodStartDate", String.valueOf(row.get("dividend_period_start_date")));
+            declaration.put("periodEndDate", String.valueOf(row.get("dividend_period_end_date")));
+            declaration.put("status", row.get("status"));
+            declarations.add(declaration);
+        }
+        return declarations;
+    }
+
+    /**
+     * A missing or disabled configuration row means the society does not make that appropriation (or has no ceiling),
+     * which is 0 — not a failure. Only an enabled row with a value applies.
+     */
+    private BigDecimal configuredPercentage(final String configurationName) {
+        final List<Map<String, Object>> rows = jdbcTemplate
+                .queryForList("SELECT value FROM c_configuration WHERE name = ? AND enabled = true", configurationName);
+        if (rows.isEmpty() || rows.get(0).get("value") == null) {
+            return BigDecimal.ZERO;
+        }
+        return new BigDecimal(String.valueOf(rows.get(0).get("value")));
+    }
+
+    private WebApplicationException apiError(final int httpStatus, final String message) {
+        return new WebApplicationException(
+                Response.status(httpStatus).entity(gson.toJson(Map.of("message", message))).type(MediaType.APPLICATION_JSON).build());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/yearend/api/IncomeProfitTransferApiResource.java

@@ -0,0 +1,180 @@
+package org.apache.fineract.accounting.yearend.api;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.accounting.yearend.service.IncomeProfitTransferService;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Financial year-end closing of the share entry fee into the Bank Profit equity GL.
+ *
+ * <p>
+ * {@code GET} reports how much is waiting to be posted for the year and what has been posted before; {@code POST}
+ * performs the closing. The scheduled job {@code Post Share Entry Fee To Profit} runs the same service on 31 March, so
+ * this endpoint is the manual equivalent — useful when the job did not run, or the accountant wants to close early.
+ */
+@Path("/v1/accounting/incomeprofittransfer")
+@Component
+@RequiredArgsConstructor
+@Consumes({ MediaType.APPLICATION_JSON })
+@Produces({ MediaType.APPLICATION_JSON })
+public class IncomeProfitTransferApiResource {
+
+    private final PlatformSecurityContext context;
+    private final JdbcTemplate jdbcTemplate;
+    private final IncomeProfitTransferService service;
+    private final Gson gson = new Gson();
+
+    // ══════════════════════════════════════════════════════════════════════
+    // GET — how much is waiting to be posted, and what has been posted before
+    // ══════════════════════════════════════════════════════════════════════
+    @GET
+    public Response preview(@QueryParam("incomeGlCode") final String incomeGlCodeParam,
+            @QueryParam("financialYear") final String financialYearParam) {
+
+        this.context.authenticatedUser();
+
+        final String incomeGlCode = incomeGlCodeParam == null || incomeGlCodeParam.isBlank()
+                ? IncomeProfitTransferService.DEFAULT_INCOME_GL_CODE
+                : incomeGlCodeParam.trim();
+        final Map<String, Object> incomeGl = service.loadGlByCode(incomeGlCode);
+        final Map<String, Object> profitGl = service.loadDistributableProfitGl();
+
+        final String financialYear = financialYearParam == null || financialYearParam.isBlank() ? service.currentFinancialYear()
+                : financialYearParam.trim();
+        final LocalDate[] range = service.financialYearRange(financialYear);
+
+        final Long incomeGlId = toLong(incomeGl.get("id"));
+        final BigDecimal pending = service.balanceOf(incomeGlId, range);
+        final int entryCount = service.entryCountOf(incomeGlId, range);
+
+        final List<Map<String, Object>> history = jdbcTemplate
+                .queryForList("SELECT t.id, t.financial_year, t.amount, t.entry_count, t.posted_on_date, t.posted_by_name, "
+                        + " t.gl_transaction_id, g.gl_code AS income_gl_code, g.name AS income_gl_name "
+                        + " FROM m_income_profit_transfer t JOIN acc_gl_account g ON g.id = t.income_gl_id "
+                        + " WHERE t.income_gl_id = ? ORDER BY t.financial_year DESC, t.id DESC", incomeGlId);
+
+        final boolean alreadyPosted = history.stream().anyMatch(h -> financialYear.equals(h.get("financial_year")));
+
+        final Map<String, Object> out = new LinkedHashMap<>();
+        out.put("financialYear", financialYear);
+        out.put("fromDate", range[0].toString());
+        out.put("toDate", range[1].toString());
+        out.put("incomeGlCode", incomeGl.get("gl_code"));
+        out.put("incomeGlName", incomeGl.get("name"));
+        out.put("profitGlCode", profitGl.get("gl_code"));
+        out.put("profitGlName", profitGl.get("name"));
+        out.put("pendingAmount", pending);
+        out.put("entryCount", entryCount);
+        out.put("alreadyPosted", alreadyPosted);
+        out.put("postedHistory", history);
+        out.put("totalPostedToProfit", history.stream().map(h -> (BigDecimal) h.get("amount")).reduce(BigDecimal.ZERO, BigDecimal::add));
+        return Response.ok(gson.toJson(out)).build();
+    }
+
+    // ══════════════════════════════════════════════════════════════════════
+    // POST — close the income GL into Bank Profit
+    // ══════════════════════════════════════════════════════════════════════
+    @POST
+    @Transactional
+    public Response post(final String body) {
+
+        final AppUser currentUser = this.context.authenticatedUser();
+        currentUser.validateHasPermissionTo("CREATE_JOURNALENTRY");
+
+        final JsonObject json = parseBody(body);
+        final String incomeGlCode = getString(json, "incomeGlCode") == null ? IncomeProfitTransferService.DEFAULT_INCOME_GL_CODE
+                : getString(json, "incomeGlCode").trim();
+        final String financialYear = getString(json, "financialYear") == null ? service.currentFinancialYear()
+                : getString(json, "financialYear").trim();
+
+        // strict = true: a manual posting reports "already closed" or "nothing to post" as an
+        // error, so the user is told why nothing happened.
+        final Map<String, Object> result = service.postToProfit(incomeGlCode, financialYear, currentUser.getId(), currentUser.getUsername(),
+                sanitiseNote(getString(json, "note")), true);
+
+        return Response.ok(gson.toJson(result)).build();
+    }
+
+    // ══════════════════════════════════════════════════════════════════════
+    // POST /close-year — close the WHOLE P&L into Bank Profit
+    // ══════════════════════════════════════════════════════════════════════
+
+    /**
+     * Closes every income and expense GL for the year, so Bank Profit ends up holding the year's real net profit.
+     *
+     * This is the full year-end close; the endpoint above closes one named income GL and remains for the narrower
+     * share-entry-fee case. The share dividend declaration reads Bank Profit as the year's profit, so it is this that
+     * has to have run — after a single-GL posting the rest of the profit is still sitting in the income accounts.
+     */
+    @POST
+    @Path("/close-year")
+    @Transactional
+    public Response closeYear(final String body) {
+
+        final AppUser currentUser = this.context.authenticatedUser();
+        currentUser.validateHasPermissionTo("CREATE_JOURNALENTRY");
+
+        final JsonObject json = parseBody(body);
+        final String financialYear = getString(json, "financialYear") == null ? service.currentFinancialYear()
+                : getString(json, "financialYear").trim();
+
+        // strict = true: a manual close reports "nothing left to close" as an error, so the user is
+        // told why nothing happened rather than getting a silent success.
+        final Map<String, Object> result = service.closeAllToProfit(financialYear, currentUser.getId(), currentUser.getUsername(),
+                sanitiseNote(getString(json, "note")), true);
+
+        return Response.ok(gson.toJson(result)).build();
+    }
+
+    // ══════════════════════════════════════════════════════════════════════
+    // Helpers
+    // ══════════════════════════════════════════════════════════════════════
+
+    private JsonObject parseBody(final String body) {
+        if (body == null || body.isBlank()) {
+            return new JsonObject();
+        }
+        try {
+            return JsonParser.parseString(body).getAsJsonObject();
+        } catch (RuntimeException e) {
+            throw new PlatformDataIntegrityException("error.msg.incomeprofit.request.invalid", "Request body must be valid JSON.");
+        }
+    }
+
+    private String sanitiseNote(final String raw) {
+        if (raw == null || raw.isBlank()) {
+            return null;
+        }
+        final String trimmed = raw.trim();
+        return trimmed.length() > 490 ? trimmed.substring(0, 490) : trimmed;
+    }
+
+    private String getString(final JsonObject json, final String field) {
+        return json.has(field) && !json.get(field).isJsonNull() ? json.get(field).getAsString() : null;
+    }
+
+    private Long toLong(final Object o) {
+        return o instanceof Number ? ((Number) o).longValue() : null;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/yearend/jobs/postshareentryfeetoprofit/PostShareEntryFeeToProfitConfig.java

@@ -0,0 +1,60 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.yearend.jobs.postshareentryfeetoprofit;
+
+import org.apache.fineract.accounting.yearend.service.IncomeProfitTransferService;
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class PostShareEntryFeeToProfitConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+    @Autowired
+    private IncomeProfitTransferService incomeProfitTransferService;
+
+    @Bean
+    protected Step postShareEntryFeeToProfitStep() {
+        return new StepBuilder(JobName.POST_SHARE_ENTRY_FEE_TO_PROFIT.name(), jobRepository)
+                .tasklet(postShareEntryFeeToProfitTasklet(), transactionManager).build();
+    }
+
+    @Bean
+    public Job postShareEntryFeeToProfitJob() {
+        return new JobBuilder(JobName.POST_SHARE_ENTRY_FEE_TO_PROFIT.name(), jobRepository).start(postShareEntryFeeToProfitStep())
+                .incrementer(new RunIdIncrementer()).build();
+    }
+
+    @Bean
+    public PostShareEntryFeeToProfitTasklet postShareEntryFeeToProfitTasklet() {
+        return new PostShareEntryFeeToProfitTasklet(incomeProfitTransferService);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/yearend/jobs/postshareentryfeetoprofit/PostShareEntryFeeToProfitTasklet.java

@@ -0,0 +1,61 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.yearend.jobs.postshareentryfeetoprofit;
+
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.accounting.yearend.service.IncomeProfitTransferService;
+import org.springframework.batch.core.StepContribution;
+import org.springframework.batch.core.scope.context.ChunkContext;
+import org.springframework.batch.core.step.tasklet.Tasklet;
+import org.springframework.batch.repeat.RepeatStatus;
+
+/**
+ * Year-end closing of the share entry fee: on 31 March the balance of Share Entry Fee Income is posted to the Bank
+ * Profit equity GL, leaving the income account at nil for the new year.
+ *
+ * <p>
+ * Runs unattended, so a no-op (already closed for the year, or no fee collected) is a normal outcome and is logged
+ * rather than failing the job. Only a genuine posting failure is raised.
+ */
+@Slf4j
+@RequiredArgsConstructor
+public class PostShareEntryFeeToProfitTasklet implements Tasklet {
+
+    /** Fineract's system user id, used because a scheduled run has no logged-in user. */
+    private static final long SYSTEM_USER_ID = 1L;
+
+    private final IncomeProfitTransferService incomeProfitTransferService;
+
+    @Override
+    public RepeatStatus execute(StepContribution contribution, ChunkContext chunkContext) throws Exception {
+        final String financialYear = incomeProfitTransferService.currentFinancialYear();
+
+        // Closes the WHOLE P&L, not just the share entry fee it was originally written for. Bank Profit
+        // is now what the share dividend declaration reads as "the year's profit", and a partial close
+        // would leave most of the profit still sitting in the income GLs — understating what may be
+        // distributed. Per-GL guards inside closeAllToProfit make a re-run safe.
+        final Map<String, Object> result = incomeProfitTransferService.closeAllToProfit(financialYear, SYSTEM_USER_ID, "system",
+                "Automatic year-end closing", false);
+
+        log.info("Year-end closing for {}: {}", financialYear, result.get("message"));
+        return RepeatStatus.FINISHED;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/yearend/service/IncomeProfitTransferService.java

@@ -0,0 +1,398 @@
+package org.apache.fineract.accounting.yearend.service;
+
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.accounting.common.DividendGlAccountResolver;
+import org.apache.fineract.accounting.glaccount.validation.GLAccountTransactionGuard;
+import org.apache.fineract.accounting.journalentry.service.LedgerTransactionId;
+import org.apache.fineract.accounting.journalentry.service.LedgerTxnPrefix;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.springframework.dao.EmptyResultDataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Closes an income GL into the Bank Profit equity GL at financial year end.
+ *
+ * <pre>
+ *   Dr  Share Entry Fee Income (10.4)   = balance for the year
+ *   Cr  Distributable Profit            (the GL mapped to that financial activity)
+ * </pre>
+ *
+ * Debiting the income account brings it back to nil so the new year starts clean; the credit accumulates in equity as
+ * retained profit.
+ *
+ * <p>
+ * Shared by the scheduled year-end job and the manual posting endpoint, so both paths post identical entries and are
+ * protected by the same "once per year" guard. The caller supplies the acting user id because the job runs without a
+ * logged-in user.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class IncomeProfitTransferService {
+
+    // Fineract convention: 1 = CREDIT, 2 = DEBIT.
+    private static final int DEBIT = 2;
+    private static final int CREDIT = 1;
+
+    /** Income GL closed to profit by the year-end job — the share entry fee. */
+    public static final String DEFAULT_INCOME_GL_CODE = "10.4";
+
+    private final JdbcTemplate jdbcTemplate;
+
+    /**
+     * The year's profit is closed into the Distributable Profit account, not the Retained one.
+     *
+     * A dividend is declared against this balance; whatever the members do not receive moves across to Retained Profit
+     * once the declaration is approved. Closing into Retained directly would mix the year just ended with earlier
+     * years' leftovers, and the next declaration would be sized on profit that had already been through a distribution
+     * decision — offering the same money for distribution twice.
+     *
+     * Both accounts are configured on Financial Activity Mappings; this was the hardcoded GL code BANKPROFITND01.
+     */
+    private final DividendGlAccountResolver dividendGlAccounts;
+
+    /**
+     * Posts the year-end transfer. Returns a summary of what was posted, or a summary with {@code posted = false} when
+     * there was nothing to do (already closed, or a nil balance) — those are normal outcomes for a scheduled run, not
+     * errors.
+     *
+     * @param strict
+     *            when true (manual posting) a no-op raises an error so the user sees why; when false (scheduled job) it
+     *            returns quietly.
+     */
+    @Transactional
+    public Map<String, Object> postToProfit(final String incomeGlCode, final String financialYear, final Long userId, final String userName,
+            final String note, final boolean strict) {
+
+        final Map<String, Object> incomeGl = loadGlByCode(incomeGlCode);
+        final Map<String, Object> profitGl = loadDistributableProfitGl();
+        final Long incomeGlId = toLong(incomeGl.get("id"));
+        final Long profitGlId = toLong(profitGl.get("id"));
+
+        final LocalDate[] range = financialYearRange(financialYear);
+        final Long officeId = headOfficeId();
+
+        final Map<String, Object> out = new LinkedHashMap<>();
+        out.put("financialYear", financialYear);
+        out.put("incomeGlCode", incomeGl.get("gl_code"));
+        out.put("incomeGlName", incomeGl.get("name"));
+        out.put("profitGlCode", profitGl.get("gl_code"));
+        out.put("profitGlName", profitGl.get("name"));
+
+        final Integer existing = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_income_profit_transfer WHERE financial_year = ? AND income_gl_id = ? AND office_id = ?",
+                Integer.class, financialYear, incomeGlId, officeId);
+        if (existing != null && existing > 0) {
+            if (strict) {
+                throw new PlatformDataIntegrityException("error.msg.incomeprofit.already.posted",
+                        incomeGl.get("name") + " has already been closed to profit for " + financialYear + ".");
+            }
+            out.put("posted", false);
+            out.put("reason", "Already closed for " + financialYear);
+            return out;
+        }
+
+        final BigDecimal balance = balanceOf(incomeGlId, range);
+        if (balance.compareTo(BigDecimal.ZERO) <= 0) {
+            if (strict) {
+                throw new PlatformDataIntegrityException("error.msg.incomeprofit.nothing.to.post",
+                        "There is no income in " + incomeGl.get("name") + " to close for " + financialYear + ".");
+            }
+            out.put("posted", false);
+            out.put("reason", "No income to close for " + financialYear);
+            return out;
+        }
+
+        final int entryCount = entryCountOf(incomeGlId, range);
+        final String currencyCode = resolveCurrency(incomeGlId);
+        final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
+        final LocalDate postingDate = range[1];
+        final String txnId = LedgerTransactionId.next(this.jdbcTemplate, LedgerTxnPrefix.YEAR_END_PROFIT);
+        final String desc = "Year-end closing " + financialYear + " — " + incomeGl.get("name") + " to profit"
+                + (note != null ? " | " + note : "");
+
+        insertEntry(officeId, incomeGlId, DEBIT, balance, txnId, postingDate, userId, now, currencyCode, desc);
+        insertEntry(officeId, profitGlId, CREDIT, balance, txnId, postingDate, userId, now, currencyCode,
+                "Profit for " + financialYear + " from " + incomeGl.get("name"));
+
+        jdbcTemplate.update(
+                "INSERT INTO m_income_profit_transfer "
+                        + "(financial_year, income_gl_id, profit_gl_id, office_id, from_date, to_date, amount, entry_count, "
+                        + " currency_code, gl_transaction_id, posted_on_date, posted_by_user, posted_by_name, note) "
+                        + "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                financialYear, incomeGlId, profitGlId, officeId, java.sql.Date.valueOf(range[0]), java.sql.Date.valueOf(range[1]), balance,
+                entryCount, currencyCode, txnId, java.sql.Date.valueOf(postingDate), userId, userName, note);
+
+        log.info("Year-end profit posting: {} {} from {} to {} for {}", balance, currencyCode, incomeGl.get("name"), profitGl.get("name"),
+                financialYear);
+
+        out.put("posted", true);
+        out.put("amountPostedToProfit", balance);
+        out.put("entryCount", entryCount);
+        out.put("postedOnDate", postingDate.toString());
+        out.put("glTransactionId", txnId);
+        out.put("currency", currencyCode);
+        out.put("message", balance + " " + currencyCode + " posted to " + profitGl.get("name") + " for " + financialYear + ".");
+        return out;
+    }
+
+    /**
+     * Closes EVERY income and expense GL into Bank Profit for the year, leaving the equity GL holding the year's real
+     * net profit.
+     *
+     * <pre>
+     *   each income GL:    Dr  Income GL      Cr  Bank Profit     (income raises profit)
+     *   each expense GL:   Dr  Bank Profit    Cr  Expense GL      (expense reduces profit)
+     * </pre>
+     *
+     * {@link #postToProfit} closes one named income GL and is what the legacy share-entry-fee job calls; this closes
+     * the whole P&L, which is what an actual year-end close is. Anything reading Bank Profit as "the year's profit" —
+     * the share dividend declaration in particular — depends on this having run, because a partial close leaves the
+     * profit split across two places and understates it.
+     *
+     * Each GL still gets its own m_income_profit_transfer row, so the same "once per year per GL" guard applies: a
+     * re-run after new GL accounts appear closes only the ones not yet closed, and never double-posts one that was.
+     * Accounts with a nil balance are skipped rather than posted as zero entries.
+     */
+    @Transactional
+    public Map<String, Object> closeAllToProfit(final String financialYear, final Long userId, final String userName, final String note,
+            final boolean strict) {
+
+        final Map<String, Object> profitGl = loadDistributableProfitGl();
+        final Long profitGlId = toLong(profitGl.get("id"));
+        final LocalDate[] range = financialYearRange(financialYear);
+        final Long officeId = headOfficeId();
+
+        // 4 = INCOME, 5 = EXPENSE (GLAccountType). Disabled accounts are excluded: they can hold a
+        // historical balance but must not attract new postings.
+        final List<Map<String, Object>> plAccounts = jdbcTemplate.queryForList(
+                "SELECT id, gl_code, name, classification_enum FROM acc_gl_account "
+                        + " WHERE classification_enum IN (4, 5) AND disabled = false ORDER BY classification_enum, gl_code");
+
+        final List<Map<String, Object>> closed = new ArrayList<>();
+        final List<Map<String, Object>> skipped = new ArrayList<>();
+        BigDecimal totalIncome = BigDecimal.ZERO;
+        BigDecimal totalExpense = BigDecimal.ZERO;
+
+        for (final Map<String, Object> gl : plAccounts) {
+            final Long glId = toLong(gl.get("id"));
+            final boolean isIncome = ((Number) gl.get("classification_enum")).intValue() == 4;
+
+            final Integer existing = jdbcTemplate.queryForObject(
+                    "SELECT COUNT(*) FROM m_income_profit_transfer WHERE financial_year = ? AND income_gl_id = ? AND office_id = ?",
+                    Integer.class, financialYear, glId, officeId);
+            if (existing != null && existing > 0) {
+                skipped.add(skipRow(gl, "Already closed for " + financialYear));
+                continue;
+            }
+
+            // balanceOf returns credit-less-debit. For an income GL that is the income earned; for an
+            // expense GL the natural balance is a debit, so the same figure comes back negative and
+            // is flipped here to read as a positive expense.
+            final BigDecimal rawBalance = balanceOf(glId, range);
+            final BigDecimal balance = isIncome ? rawBalance : rawBalance.negate();
+            if (balance.compareTo(BigDecimal.ZERO) <= 0) {
+                skipped.add(skipRow(gl, "Nothing to close for " + financialYear));
+                continue;
+            }
+
+            final int entryCount = entryCountOf(glId, range);
+            final String currencyCode = resolveCurrency(glId);
+            final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
+            final LocalDate postingDate = range[1];
+            final String txnId = LedgerTransactionId.next(this.jdbcTemplate, LedgerTxnPrefix.YEAR_END_CLOSE);
+            final String descr = "Year-end closing " + financialYear + " — " + gl.get("name") + " to profit"
+                    + (note != null ? " | " + note : "");
+
+            if (isIncome) {
+                insertEntry(officeId, glId, DEBIT, balance, txnId, postingDate, userId, now, currencyCode, descr);
+                insertEntry(officeId, profitGlId, CREDIT, balance, txnId, postingDate, userId, now, currencyCode,
+                        "Profit for " + financialYear + " from " + gl.get("name"));
+                totalIncome = totalIncome.add(balance);
+            } else {
+                insertEntry(officeId, glId, CREDIT, balance, txnId, postingDate, userId, now, currencyCode, descr);
+                insertEntry(officeId, profitGlId, DEBIT, balance, txnId, postingDate, userId, now, currencyCode,
+                        "Expense for " + financialYear + " from " + gl.get("name"));
+                totalExpense = totalExpense.add(balance);
+            }
+
+            jdbcTemplate.update("INSERT INTO m_income_profit_transfer "
+                    + "(financial_year, income_gl_id, profit_gl_id, office_id, from_date, to_date, amount, entry_count, "
+                    + " currency_code, gl_transaction_id, posted_on_date, posted_by_user, posted_by_name, note) "
+                    + "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)", financialYear, glId, profitGlId, officeId,
+                    java.sql.Date.valueOf(range[0]), java.sql.Date.valueOf(range[1]), balance, entryCount, currencyCode, txnId,
+                    java.sql.Date.valueOf(postingDate), userId, userName, note);
+
+            final Map<String, Object> row = new LinkedHashMap<>();
+            row.put("glCode", gl.get("gl_code"));
+            row.put("glName", gl.get("name"));
+            row.put("type", isIncome ? "INCOME" : "EXPENSE");
+            row.put("amount", balance);
+            row.put("entryCount", entryCount);
+            row.put("glTransactionId", txnId);
+            closed.add(row);
+        }
+
+        if (closed.isEmpty() && strict) {
+            throw new PlatformDataIntegrityException("error.msg.incomeprofit.nothing.to.close",
+                    "There is nothing left to close to profit for " + financialYear + ".");
+        }
+
+        final BigDecimal netProfit = totalIncome.subtract(totalExpense);
+        log.info("Year-end close {}: income {}, expense {}, net profit {} posted to {}", financialYear, totalIncome, totalExpense,
+                netProfit, profitGl.get("name"));
+
+        final Map<String, Object> out = new LinkedHashMap<>();
+        out.put("financialYear", financialYear);
+        out.put("fromDate", range[0].toString());
+        out.put("toDate", range[1].toString());
+        out.put("profitGlCode", profitGl.get("gl_code"));
+        out.put("profitGlName", profitGl.get("name"));
+        out.put("totalIncomeClosed", totalIncome);
+        out.put("totalExpenseClosed", totalExpense);
+        out.put("netProfitPosted", netProfit);
+        out.put("accountsClosed", closed);
+        out.put("accountsSkipped", skipped);
+        out.put("message", closed.size() + " account(s) closed to " + profitGl.get("name") + " for " + financialYear + "; net profit "
+                + netProfit + ".");
+        return out;
+    }
+
+    private Map<String, Object> skipRow(final Map<String, Object> gl, final String reason) {
+        final Map<String, Object> row = new LinkedHashMap<>();
+        row.put("glCode", gl.get("gl_code"));
+        row.put("glName", gl.get("name"));
+        row.put("reason", reason);
+        return row;
+    }
+
+    /**
+     * The year's profit as it stands in the Bank Profit equity GL — what a dividend may be declared out of once the
+     * year has been closed.
+     *
+     * Only entries dated inside the financial year count, so each year's profit is separable rather than being one
+     * ever-growing equity balance. Returns zero (not an error) when the year has not been closed yet; callers decide
+     * whether that is a blocking condition.
+     */
+    public BigDecimal profitForFinancialYear(final String financialYear) {
+        final LocalDate[] range = financialYearRange(financialYear);
+        final Map<String, Object> profitGl = loadDistributableProfitGl();
+        final BigDecimal balance = jdbcTemplate.queryForObject(
+                "SELECT COALESCE(SUM(CASE WHEN type_enum = ? THEN amount ELSE -amount END), 0) "
+                        + " FROM acc_gl_journal_entry WHERE account_id = ? AND reversed = false AND entry_date BETWEEN ? AND ?",
+                BigDecimal.class, CREDIT, toLong(profitGl.get("id")), java.sql.Date.valueOf(range[0]), java.sql.Date.valueOf(range[1]));
+        return balance == null ? BigDecimal.ZERO : balance;
+    }
+
+    /** Whether the year's P&L has been closed into Bank Profit at all. */
+    public boolean isYearClosed(final String financialYear) {
+        final Integer count = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_income_profit_transfer WHERE financial_year = ?",
+                Integer.class, financialYear);
+        return count != null && count > 0;
+    }
+
+    /** Net credit balance sitting in the income GL for the year. */
+    public BigDecimal balanceOf(final Long incomeGlId, final LocalDate[] range) {
+        final BigDecimal balance = jdbcTemplate.queryForObject(
+                "SELECT COALESCE(SUM(CASE WHEN type_enum = ? THEN amount ELSE -amount END), 0) "
+                        + " FROM acc_gl_journal_entry WHERE account_id = ? AND reversed = false " + "   AND entry_date BETWEEN ? AND ?",
+                BigDecimal.class, CREDIT, incomeGlId, java.sql.Date.valueOf(range[0]), java.sql.Date.valueOf(range[1]));
+        return balance == null ? BigDecimal.ZERO : balance;
+    }
+
+    /** How many fee postings made up that balance. */
+    public int entryCountOf(final Long incomeGlId, final LocalDate[] range) {
+        final Integer count = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM acc_gl_journal_entry WHERE account_id = ? AND reversed = false "
+                        + " AND type_enum = ? AND entry_date BETWEEN ? AND ?",
+                Integer.class, incomeGlId, CREDIT, java.sql.Date.valueOf(range[0]), java.sql.Date.valueOf(range[1]));
+        return count == null ? 0 : count;
+    }
+
+    /** Indian financial year label for today, e.g. "2026-27" for 19 Aug 2026. */
+    public String currentFinancialYear() {
+        final LocalDate today = DateUtils.getBusinessLocalDate();
+        final int startYear = today.getMonthValue() >= 4 ? today.getYear() : today.getYear() - 1;
+        return startYear + "-" + String.format("%02d", (startYear + 1) % 100);
+    }
+
+    /** 1 April to 31 March for a "YYYY-YY" label. */
+    public LocalDate[] financialYearRange(final String financialYear) {
+        try {
+            final int startYear = Integer.parseInt(financialYear.substring(0, 4));
+            return new LocalDate[] { LocalDate.of(startYear, 4, 1), LocalDate.of(startYear + 1, 3, 31) };
+        } catch (RuntimeException e) {
+            throw new PlatformDataIntegrityException("error.msg.incomeprofit.year.invalid",
+                    "financialYear must look like 2026-27. Received: " + financialYear);
+        }
+    }
+
+    public Map<String, Object> loadGlByCode(final String glCode) {
+        try {
+            return jdbcTemplate.queryForMap("SELECT id, gl_code, name, classification_enum FROM acc_gl_account WHERE gl_code = ?", glCode);
+        } catch (EmptyResultDataAccessException e) {
+            throw new PlatformDataIntegrityException("error.msg.incomeprofit.gl.not.found", "GL account " + glCode + " does not exist.");
+        }
+    }
+
+    /** As {@link #loadGlByCode}, for an account already identified by a financial activity mapping. */
+    public Map<String, Object> loadGlById(final Long glAccountId) {
+        try {
+            return jdbcTemplate.queryForMap("SELECT id, gl_code, name, classification_enum FROM acc_gl_account WHERE id = ?", glAccountId);
+        } catch (EmptyResultDataAccessException e) {
+            throw new PlatformDataIntegrityException("error.msg.incomeprofit.gl.not.found",
+                    "GL account " + glAccountId + " does not exist.");
+        }
+    }
+
+    /** The distributable-profit GL the year's income closes into, as configured on Financial Activity Mappings. */
+    public Map<String, Object> loadDistributableProfitGl() {
+        return loadGlById(this.dividendGlAccounts.distributableProfitAccount());
+    }
+
+    public Long headOfficeId() {
+        return jdbcTemplate.queryForObject("SELECT id FROM m_office ORDER BY hierarchy LIMIT 1", Long.class);
+    }
+
+    private String resolveCurrency(final Long glAccountId) {
+        try {
+            final String code = jdbcTemplate.queryForObject(
+                    "SELECT currency_code FROM acc_gl_journal_entry WHERE account_id = ? ORDER BY id DESC LIMIT 1", String.class,
+                    glAccountId);
+            return code == null ? "INR" : code;
+        } catch (EmptyResultDataAccessException e) {
+            return "INR";
+        }
+    }
+
+    private void insertEntry(final Long officeId, final Long glAccountId, final int typeEnum, final BigDecimal amount, final String txnId,
+            final LocalDate entryDate, final Long userId, final LocalDateTime now, final String currencyCode, final String description) {
+        GLAccountTransactionGuard.assertPostable(jdbcTemplate, glAccountId);
+        jdbcTemplate.update(
+                "INSERT INTO acc_gl_journal_entry " + "(account_id, office_id, currency_code, transaction_id, reversed, manual_entry, "
+                        + " entry_date, type_enum, amount, description, "
+                        + " created_by, last_modified_by, created_date, lastmodified_date, "
+                        + " is_running_balance_calculated, office_running_balance, "
+                        + " organization_running_balance, submitted_on_date, transaction_date, " + " created_on_utc, last_modified_on_utc) "
+                        + "VALUES (?,?,?,?,false,true,?,?,?,?,?,?,?,?,false,0,0,?,?,?,?)",
+                glAccountId, officeId, currencyCode, txnId, java.sql.Date.valueOf(entryDate), typeEnum, amount, description, userId, userId,
+                now, now, java.sql.Date.valueOf(entryDate), java.sql.Date.valueOf(entryDate), now.atOffset(ZoneOffset.UTC),
+                now.atOffset(ZoneOffset.UTC));
+    }
+
+    private Long toLong(final Object o) {
+        return o instanceof Number ? ((Number) o).longValue() : null;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/businessdate/jobs/syncbusinessdate/SyncBusinessDateConfig.java

@@ -0,0 +1,52 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.businessdate.jobs.syncbusinessdate;
+
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class SyncBusinessDateConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+
+    @Bean
+    protected Step syncBusinessDateStep(final SyncBusinessDateTasklet syncBusinessDateTasklet) {
+        return new StepBuilder(JobName.SYNC_BUSINESS_DATE_TO_SYSTEM_DATE.name(), jobRepository)
+                .tasklet(syncBusinessDateTasklet, transactionManager).build();
+    }
+
+    @Bean
+    public Job syncBusinessDateJob(final SyncBusinessDateTasklet syncBusinessDateTasklet) {
+        return new JobBuilder(JobName.SYNC_BUSINESS_DATE_TO_SYSTEM_DATE.name(), jobRepository)
+                .start(syncBusinessDateStep(syncBusinessDateTasklet)).incrementer(new RunIdIncrementer()).build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/businessdate/jobs/syncbusinessdate/SyncBusinessDateTasklet.java

@@ -0,0 +1,88 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.businessdate.jobs.syncbusinessdate;
+
+import java.time.LocalDate;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.businessdate.data.service.BusinessDateDTO;
+import org.apache.fineract.infrastructure.businessdate.domain.BusinessDateType;
+import org.apache.fineract.infrastructure.businessdate.service.BusinessDateWritePlatformService;
+import org.apache.fineract.infrastructure.configuration.domain.ConfigurationDomainService;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.springframework.batch.core.StepContribution;
+import org.springframework.batch.core.scope.context.ChunkContext;
+import org.springframework.batch.core.step.tasklet.Tasklet;
+import org.springframework.batch.repeat.RepeatStatus;
+import org.springframework.stereotype.Component;
+
+/**
+ * Sets the business date to the tenant's own calendar date, every midnight.
+ *
+ * <p>
+ * Fineract's stock job adds one day to whatever the business date already holds. That is only the
+ * same thing as "today" while the scheduler has never missed a night: a server stopped over a
+ * weekend, a laptop that was closed, a tenant restored from an older backup, and the date is left
+ * behind by however many runs did not happen. It then stays behind, because adding a day to a stale
+ * date gives another stale date, and each night's run preserves the gap rather than closing it.
+ *
+ * <p>
+ * Drift is not a cosmetic problem. Every transaction is stamped with the business date, so while it
+ * lags: a Demand Draft raised today is rejected as being dated in the future, the day's savings
+ * interest never accrues and a closure pays out short, and staff see yesterday's date on work they
+ * are doing now.
+ *
+ * <p>
+ * Reading the clock instead of incrementing is self-correcting: however many days were missed, the
+ * next run lands on today. Bringing the date forward is all this does — a date deliberately set
+ * ahead, which is how testing against a future day works, is left alone rather than pulled back
+ * under someone's feet.
+ */
+@Slf4j
+@RequiredArgsConstructor
+@Component
+public class SyncBusinessDateTasklet implements Tasklet {
+
+    private final BusinessDateWritePlatformService businessDateWritePlatformService;
+    private final ConfigurationDomainService configurationDomainService;
+
+    @Override
+    public RepeatStatus execute(final StepContribution contribution, final ChunkContext chunkContext) {
+        if (!configurationDomainService.isBusinessDateEnabled()) {
+            // Without the setting on, the platform reads the clock directly and m_business_date is
+            // not consulted — writing to it would be busywork that misleads anyone reading the table.
+            log.debug("Business date is not enabled; nothing to sync.");
+            return RepeatStatus.FINISHED;
+        }
+
+        final LocalDate systemDate = DateUtils.getLocalDateOfTenant();
+        final LocalDate businessDate = DateUtils.getBusinessLocalDate();
+
+        if (!businessDate.isBefore(systemDate)) {
+            log.debug("Business date {} is already at or ahead of the system date {}; leaving it alone.", businessDate, systemDate);
+            return RepeatStatus.FINISHED;
+        }
+
+        businessDateWritePlatformService.updateBusinessDate(BusinessDateDTO.builder().type(BusinessDateType.BUSINESS_DATE)
+                .description(BusinessDateType.BUSINESS_DATE.getDescription()).date(systemDate).build());
+
+        log.info("Business date moved from {} to the system date {}.", businessDate, systemDate);
+        return RepeatStatus.FINISHED;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/configuration/domain/ConfigurationDomainServiceJpa.java

@@ -61,6 +61,11 @@ public class ConfigurationDomainServiceJpa implements ConfigurationDomainService
         return false;
     }
 
+    @Override
+    public boolean isMakerCheckerEnabled() {
+        return getGlobalConfigurationPropertyData(GlobalConfigurationConstants.MAKER_CHECKER).isEnabled();
+    }
+
     @Override
     public List<String> getAllowedLoanStatusesForExternalAssetTransfer() {
         final GlobalConfigurationPropertyData property = getGlobalConfigurationPropertyData(

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java

@@ -33,6 +33,7 @@ import org.apache.fineract.infrastructure.configuration.domain.ConfigurationDoma
 import org.apache.fineract.infrastructure.core.domain.FineractRequestContextHolder;
 import org.apache.fineract.infrastructure.core.filters.CallerIpTrackingFilter;
 import org.apache.fineract.infrastructure.core.filters.CorrelationHeaderFilter;
+import org.apache.fineract.infrastructure.core.filters.DisabledFeatureApiFilter;
 import org.apache.fineract.infrastructure.core.filters.IdempotencyStoreFilter;
 import org.apache.fineract.infrastructure.core.filters.IdempotencyStoreHelper;
 import org.apache.fineract.infrastructure.core.filters.RequestResponseFilter;
@@ -163,6 +164,24 @@ public class SecurityConfig {
                     // packages here without a Fineract Bearer token; security is enforced by the
                     // envelope's RSA signature/encryption (NpciCryptoUtil) inside the handler.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/npci/**")).permitAll()
+                    // Client account summary, third-party callers — a partner integration calls this
+                    // with an X-Api-Key header instead of a Fineract username/password (issued via
+                    // POST /v1/apiclients, super-user only). Same posture as IMPS/NPCI above: the
+                    // outer gate stays open for this one narrow GET path, and
+                    // ClientAllAccountsApiResource#retrieveByClientNo is what actually authenticates
+                    // the caller (ApiClientCredentialService checks the key's hash, active flag and
+                    // IP allowlist) — a request with no key and no Fineract login still gets nothing,
+                    // it just fails inside the handler instead of at this filter.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/clientaccounts/**")).permitAll()
+                    // Tenant menu access — same dual-mode X-Api-Key posture as clientaccounts above
+                    // for the two GETs (TenantMenuAccessApiResource#read still requires an ordinary
+                    // session when no key is sent, same as ClientAllAccountsApiResource does; permitAll
+                    // here only opens Spring Security's outer gate for the key path, it does not skip
+                    // the handler's own check). The PUT has no session fallback inside the handler at
+                    // all, even for a logged-in super user — see TenantMenuAccessApiResource#save.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/tenant-menu-access")).permitAll()
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/tenant-menu-access/tenants")).permitAll()
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/tenant-menu-access")).permitAll()
                     // Login OTP — same posture as PAN/GSTIN public verification: provider-credentialed,
                     // no Fineract auth required.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/login/otp/generate")).permitAll()
@@ -408,7 +427,10 @@ public class SecurityConfig {
                 .addFilterBefore(tenantAwareBasicAuthenticationFilter(), SecurityContextHolderFilter.class)
                 .addFilterAfter(requestResponseFilter(), ExceptionTranslationFilter.class)
                 .addFilterAfter(correlationHeaderFilter(), RequestResponseFilter.class)
-                .addFilterAfter(fineractInstanceModeApiFilter(), CorrelationHeaderFilter.class);
+                .addFilterAfter(fineractInstanceModeApiFilter(), CorrelationHeaderFilter.class)
+                // Refuses the handful of accounting features switched off for this installation.
+                // Nothing is deleted - see DisabledFeatureApiFilter for what is blocked and why.
+                .addFilterAfter(disabledFeatureApiFilter(), FineractInstanceModeApiFilter.class);
 
         if (loanCOBFilterHelper != null) {
             http.addFilterAfter(loanCOBApiFilter(), FineractInstanceModeApiFilter.class).addFilterAfter(idempotencyStoreFilter(),
@@ -445,6 +467,10 @@ public class SecurityConfig {
         return new RequestResponseFilter();
     }
 
+    public DisabledFeatureApiFilter disabledFeatureApiFilter() {
+        return new DisabledFeatureApiFilter();
+    }
+
     public LoanCOBApiFilter loanCOBApiFilter() {
         return new LoanCOBApiFilter(loanCOBFilterHelper);
     }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/filters/DisabledFeatureApiFilter.java

@@ -0,0 +1,128 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.core.filters;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+/**
+ * Turns off a handful of accounting features at the HTTP edge, without deleting any of the code
+ * behind them: the resources, services and command handlers all stay exactly as they are, and only
+ * an inbound API call is refused. Re-enabling a feature is deleting its rule from RULES below.
+ *
+ * Blocking here rather than inside the resources matters for one specific reason: several internal
+ * flows raise journal entries through CommandWrapperBuilder().createJournalEntry() in Java
+ * (ClerkDisbursementRequestApiResource's GL offsets, clerk closure rounding, bank transfers). Those
+ * never travel over HTTP, so they keep working, while the "Create Journal Entries" screen and any
+ * direct call to the endpoint are refused.
+ *
+ * A rule carries an optional set of allowed "command" query parameter values, because
+ * POST /v1/journalentries is three different features behind one path: no command is the manual
+ * journal entry screen (blocked), command=defineOpeningBalance is Migrate Opening Balances and
+ * command=updateRunningBalance is the running-balance maintenance job (both still needed).
+ */
+public class DisabledFeatureApiFilter extends OncePerRequestFilter {
+
+    private record Rule(String feature, Set<String> methods, Pattern path, Set<String> allowedCommands) {
+
+        boolean matches(final String method, final String pathInfo, final String command) {
+            if (!methods.isEmpty() && !methods.contains(method)) {
+                return false;
+            }
+            if (!path.matcher(pathInfo).matches()) {
+                return false;
+            }
+            // A command this rule explicitly spares (a different feature sharing the same path).
+            return !(command != null && allowedCommands.contains(command));
+        }
+    }
+
+    private static final List<Rule> RULES = List.of(
+            // Create Journal Entries, and Frequent Postings which posts through the same endpoint.
+            new Rule("Create Journal Entries", Set.of("POST"), Pattern.compile("/v[1-9][0-9]*/journalentries/?"),
+                    Set.of("defineOpeningBalance", "updateRunningBalance")),
+            // Closing Entries.
+            new Rule("Closing Entries", Set.of(), Pattern.compile("/v[1-9][0-9]*/glclosures(/.*)?"), Set.of()),
+            // Accruals.
+            new Rule("Accruals", Set.of(), Pattern.compile("/v[1-9][0-9]*/runaccruals(/.*)?"), Set.of()),
+            // Provisioning Entries, including the journal entries screen that belongs to it.
+            new Rule("Provisioning Entries", Set.of(), Pattern.compile("/v[1-9][0-9]*/provisioningentries(/.*)?"), Set.of()),
+            new Rule("Provisioning Entries", Set.of(), Pattern.compile("/v[1-9][0-9]*/journalentries/provisioning/?"), Set.of()),
+            // Accounting Rules. Only the Accounting Rules screens and Frequent Postings (disabled
+            // above) read these, so nothing still reachable depends on them.
+            new Rule("Accounting Rules", Set.of(), Pattern.compile("/v[1-9][0-9]*/accountingrules(/.*)?"), Set.of()));
+
+    @Override
+    protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain)
+            throws ServletException, IOException {
+
+        final String pathInfo = request.getPathInfo();
+        if (StringUtils.isBlank(pathInfo)) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        final String method = request.getMethod();
+        // Read "command" out of the query string rather than through getParameter(): the latter
+        // triggers servlet parameter parsing, which for a form-encoded or multipart POST consumes
+        // the request body before the resource ever sees it. This filter sits in front of every
+        // API call, so it must not touch the body of requests it has no interest in.
+        final String command = commandFromQueryString(request.getQueryString());
+        for (final Rule rule : RULES) {
+            if (rule.matches(method, pathInfo, command)) {
+                reject(response, rule.feature());
+                return;
+            }
+        }
+        filterChain.doFilter(request, response);
+    }
+
+    private String commandFromQueryString(final String queryString) {
+        if (StringUtils.isBlank(queryString)) {
+            return null;
+        }
+        for (final String pair : queryString.split("&")) {
+            if (pair.startsWith("command=")) {
+                return URLDecoder.decode(pair.substring("command=".length()), StandardCharsets.UTF_8);
+            }
+        }
+        return null;
+    }
+
+    private void reject(final HttpServletResponse response, final String feature) throws IOException {
+        response.setStatus(HttpStatus.SC_FORBIDDEN);
+        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+        response.getWriter()
+                .write("{\"developerMessage\":\"" + feature + " is disabled on this installation.\","
+                        + "\"httpStatusCode\":\"403\",\"defaultUserMessage\":\"" + feature + " is not available.\","
+                        + "\"userMessageGlobalisationCode\":\"error.msg.feature.disabled\"}");
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/service/JobSchedulerServiceImpl.java

@@ -66,6 +66,23 @@ public class JobSchedulerServiceImpl implements ApplicationListener<ContextRefre
             final List<ScheduledJobDetail> scheduledJobDetails = schedularWritePlatformService
                     .retrieveAllJobs(fineractProperties.getNodeId());
             for (final ScheduledJobDetail jobDetails : scheduledJobDetails) {
+                // Release any currently_running flag left over from before this boot.
+                //
+                // The flag is set in the scheduler's veto check before a job's body runs and cleared
+                // by the Quartz listener when it returns. Two things leave it set with nothing
+                // running: a JVM that stopped mid-run, and a job started through its own API rather
+                // than through Quartz — no listener is involved there, so nothing ever clears it.
+                //
+                // Once set, the veto silently drops every later trigger: no run-history row, no
+                // error, nothing in the log. The job reads as though it ran and did nothing, and one
+                // dead run mutes it for good. That is how a night of unpaid savings interest goes
+                // unnoticed.
+                //
+                // This loop is the platform coming up, so by definition none of these jobs is
+                // running: whatever the flag says, it is stale. scheduleJob() below already clears
+                // it on the paths it reaches, but not when it throws before that line, and the
+                // saveOrUpdate() after this loop persists whatever we set here either way.
+                jobDetails.setCurrentlyRunning(false);
                 try {
                     jobRegisterService.scheduleJob(jobDetails);
                 } catch (JobIsNotFoundOrNotEnabledException e) {

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/ApiClientAdminApiResource.java

@@ -0,0 +1,109 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.apiclient;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonElement;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.springframework.stereotype.Component;
+
+/**
+ * Admin-only management of the third-party API keys {@link ApiClientCredentialService} authenticates.
+ * This resource itself requires a normal Fineract login, same as everything else -- ordinary
+ * username/password, restricted to a super user (ALL_FUNCTIONS). Only the endpoints that use a minted
+ * key to skip login (e.g. GET /v1/clientaccounts) are the ones exempted in SecurityConfig; issuing that
+ * key in the first place is not something to hand to just anyone.
+ */
+@Path("/v1/apiclients")
+@Component
+@Tag(name = "API Client Keys", description = "Admin management of third-party API keys used by endpoints that skip Fineract login.")
+@RequiredArgsConstructor
+public class ApiClientAdminApiResource {
+
+    private final PlatformSecurityContext context;
+    private final ApiClientCredentialService credentialService;
+    private final FromJsonHelper fromJsonHelper;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    @POST
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public String create(final String body) {
+        final AppUser user = requireSuperUser();
+        final JsonElement root = fromJsonHelper.parse(body);
+        final String clientName = fromJsonHelper.extractStringNamed("clientName", root);
+        final String allowedIps = fromJsonHelper.extractStringNamed("allowedIps", root);
+
+        final Map<String, Object> result = credentialService.createClient(clientName, allowedIps, user.getId());
+        return gson.toJson(result);
+    }
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public String list() {
+        requireSuperUser();
+        final List<Map<String, Object>> clients = credentialService.listClients();
+        return gson.toJson(clients);
+    }
+
+    @DELETE
+    @Path("/{id}")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String deactivate(@PathParam("id") final Long id) {
+        requireSuperUser();
+        credentialService.setActive(id, false);
+        return gson.toJson(Map.of("resourceId", id, "isActive", false));
+    }
+
+    @POST
+    @Path("/{id}/reactivate")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String reactivate(@PathParam("id") final Long id) {
+        requireSuperUser();
+        credentialService.setActive(id, true);
+        return gson.toJson(Map.of("resourceId", id, "isActive", true));
+    }
+
+    private AppUser requireSuperUser() {
+        final AppUser user = context.authenticatedUser();
+        if (!user.hasAnyPermission("ALL_FUNCTIONS")) {
+            throw new WebApplicationException(Response.status(403)
+                    .entity("{\"message\":\"Only a super user can manage third-party API keys.\"}").type(MediaType.APPLICATION_JSON)
+                    .build());
+        }
+        return user;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/ApiClientCredentialService.java

@@ -0,0 +1,243 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.apiclient;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import javax.sql.DataSource;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Authenticates third-party callers of endpoints that are meant to be reachable WITHOUT a Fineract user
+ * login -- an {@code X-Api-Key} header instead of a username/password. Same posture already used in this
+ * fork for the IMPS and NPCI receivers ({@code SecurityConfig}: those paths are {@code permitAll()} at
+ * the Spring Security layer, and the handler itself verifies the caller's credential): the outer gate
+ * stays open for the specific path, and this class is the thing that actually decides "yes" or "no".
+ *
+ * {@code m_api_client} lives in the tenant-STORE database ({@code fineract_tenants}), reached here via
+ * the {@code hikariTenantDataSource}-qualified {@link DataSource} -- the same bean
+ * {@code TenantDatabaseUpgradeService} uses to manage that database -- rather than the ordinary
+ * tenant-routed {@code JdbcTemplate} every other resource in this fork injects. That is deliberate, not
+ * an oversight: a key is a caller's identity, independent of which bank's data a given request is asking
+ * for, so one minted key must keep working against every tenant that exists now AND every one
+ * provisioned later. A copy of this table inside each bank's own tenant database would need a manual
+ * re-insert on every new bank, and every key would still need one row per tenant -- exactly what storing
+ * it centrally, once, avoids. {@code Fineract-Platform-TenantId} keeps doing what it always did (routes
+ * the REST of the request, e.g. {@code ClientAllAccountsApiResource}'s own client/account lookups, to
+ * the right bank's database) -- this class only ever touches the one central table.
+ *
+ * Security properties, deliberately:
+ * <ul>
+ * <li>Only a SHA-256 hash of the key is ever stored ({@code m_api_client.api_key_hash}). A leaked
+ * database backup can never be turned back into a usable credential -- the same reason Fineract itself
+ * never stores a user's plaintext password.</li>
+ * <li>The raw key is shown to the caller (well, the admin minting it) exactly once, at creation. It is
+ * not retrievable afterwards, by design -- if it's lost, the only recourse is to mint a new one and
+ * deactivate the old.</li>
+ * <li>{@code authenticate()} raises the SAME 401 message ("Invalid or inactive API key.") whether the key
+ * doesn't exist, is deactivated, or the caller's IP isn't on its allowlist -- so a probing attacker
+ * cannot use the response to tell a wrong key apart from a valid-but-blocked one.</li>
+ * <li>The IP allowlist is a plain comma-separated exact-match list, not CIDR ranges -- adequate for a
+ * small, known set of partner integrations; if a partner calls from a rotating pool of addresses, leave
+ * {@code allowedIps} null for that key rather than trying to enumerate every address.</li>
+ * </ul>
+ */
+@Component
+@RequiredArgsConstructor
+public class ApiClientCredentialService {
+
+    private static final String GENERIC_AUTH_FAILURE = "Invalid or inactive API key.";
+    // Enough random bytes that guessing is infeasible (256 bits) -- the same order of magnitude as a
+    // session token, appropriate for a credential that never expires on its own.
+    private static final int KEY_ENTROPY_BYTES = 32;
+
+    @Qualifier("hikariTenantDataSource")
+    private final DataSource tenantStoreDataSource;
+    private final SecureRandom secureRandom = new SecureRandom();
+
+    // Built once from the qualified DataSource in @PostConstruct rather than injected directly as a
+    // JdbcTemplate: @RequiredArgsConstructor only wires constructor parameters straight from fields,
+    // and JdbcTemplate itself isn't a bean registered under this qualifier -- only the DataSource is.
+    private JdbcTemplate tenantStoreJdbc;
+
+    @PostConstruct
+    void init() {
+        this.tenantStoreJdbc = new JdbcTemplate(tenantStoreDataSource);
+    }
+
+    /**
+     * Validates a raw {@code X-Api-Key} header value. On success, returns the registered client's
+     * display name (for the caller to log/attribute the request to) and records this call -- including
+     * which tenant it was made against -- as the key's most recent use. On any failure, throws a clean
+     * 401; the caller never gets far enough to tell a wrong key from a deactivated one or a blocked IP.
+     */
+    public String authenticate(final String rawApiKey, final String callerIp) {
+        if (StringUtils.isBlank(rawApiKey)) {
+            throw unauthorized();
+        }
+        final String hash = sha256Hex(rawApiKey);
+        final List<Map<String, Object>> rows = tenantStoreJdbc.queryForList("""
+                SELECT id, client_name, is_active, allowed_ips FROM m_api_client WHERE api_key_hash = ?
+                """, hash);
+        if (rows.isEmpty()) {
+            throw unauthorized();
+        }
+        final Map<String, Object> row = rows.get(0);
+        if (!Boolean.TRUE.equals(row.get("is_active"))) {
+            throw unauthorized();
+        }
+        final String allowedIps = (String) row.get("allowed_ips");
+        if (StringUtils.isNotBlank(allowedIps) && !isIpAllowed(allowedIps, callerIp)) {
+            throw unauthorized();
+        }
+
+        final Long id = ((Number) row.get("id")).longValue();
+        tenantStoreJdbc.update("UPDATE m_api_client SET last_used_at = ?, last_used_ip = ?, last_used_tenant = ? WHERE id = ?",
+                java.sql.Timestamp.from(Instant.now()), callerIp, currentTenantId(), id);
+
+        return (String) row.get("client_name");
+    }
+
+    private boolean isIpAllowed(final String allowedIps, final String callerIp) {
+        if (StringUtils.isBlank(callerIp)) {
+            return false;
+        }
+        return Arrays.stream(allowedIps.split(",")).map(String::trim).anyMatch(ip -> ip.equalsIgnoreCase(callerIp));
+    }
+
+    /**
+     * Admin operation: mints a new key and returns it in the response -- the ONLY time the raw value
+     * is ever available. {@code allowedIps} may be null/blank for no IP restriction. The resulting key
+     * authenticates against every tenant, regardless of which one the admin minting it happened to be
+     * logged into.
+     */
+    public Map<String, Object> createClient(final String clientName, final String allowedIps, final Long createdByUserId) {
+        if (StringUtils.isBlank(clientName)) {
+            throw badRequest("clientName is required.");
+        }
+        final String rawKey = generateRawKey();
+        final String hash = sha256Hex(rawKey);
+        final String prefix = rawKey.substring(0, Math.min(12, rawKey.length()));
+
+        final Long id = tenantStoreJdbc.queryForObject("""
+                INSERT INTO m_api_client (client_name, api_key_hash, api_key_prefix, allowed_ips, created_by, created_by_tenant)
+                VALUES (?,?,?,?,?,?)
+                RETURNING id
+                """, Long.class, clientName, hash, prefix, StringUtils.isBlank(allowedIps) ? null : allowedIps, createdByUserId,
+                currentTenantId());
+
+        final Map<String, Object> result = new LinkedHashMap<>();
+        result.put("id", id);
+        result.put("clientName", clientName);
+        result.put("apiKey", rawKey);
+        result.put("warning", "This is the only time the full API key is shown. Store it now -- it cannot be retrieved again.");
+        return result;
+    }
+
+    public List<Map<String, Object>> listClients() {
+        return tenantStoreJdbc.queryForList("""
+                SELECT id, client_name, api_key_prefix, is_active, allowed_ips,
+                       created_date, created_by_tenant, deactivated_date, last_used_at, last_used_ip, last_used_tenant
+                  FROM m_api_client ORDER BY created_date DESC
+                """);
+    }
+
+    public void setActive(final Long id, final boolean active) {
+        final int updated = tenantStoreJdbc.update(
+                "UPDATE m_api_client SET is_active = ?, deactivated_date = ? WHERE id = ?", active,
+                active ? null : java.sql.Timestamp.from(Instant.now()), id);
+        if (updated == 0) {
+            throw notFound("No API client with id " + id);
+        }
+    }
+
+    private String currentTenantId() {
+        try {
+            return ThreadLocalContextUtil.getTenant().getTenantIdentifier();
+        } catch (final RuntimeException e) {
+            // Defensive only: every request through SecurityConfig's matcher chain has a tenant
+            // resolved before it reaches here (see TenantAwareBasicAuthenticationFilter), so this
+            // should be unreachable in practice.
+            return null;
+        }
+    }
+
+    private String generateRawKey() {
+        final byte[] bytes = new byte[KEY_ENTROPY_BYTES];
+        secureRandom.nextBytes(bytes);
+        // URL-safe, no padding: safe to put directly in a header value with no further encoding.
+        return "cbsx_" + Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+    }
+
+    private String sha256Hex(final String raw) {
+        try {
+            final MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            final byte[] hashBytes = digest.digest(raw.getBytes(StandardCharsets.UTF_8));
+            final StringBuilder hex = new StringBuilder(hashBytes.length * 2);
+            for (final byte b : hashBytes) {
+                hex.append(String.format("%02x", b));
+            }
+            return hex.toString();
+        } catch (final NoSuchAlgorithmException e) {
+            // SHA-256 is a mandatory JCE algorithm on every JVM distribution Fineract supports --
+            // this can only mean a broken JVM install, not a recoverable runtime condition.
+            throw new IllegalStateException("SHA-256 is unavailable in this JVM", e);
+        }
+    }
+
+    private WebApplicationException unauthorized() {
+        // Naming the tenant the caller sent is safe here -- it is the header value they themselves
+        // put on the request, not something this check reveals to them -- and it turns "why did my
+        // key fail" from a guess into something checkable: was this call even reaching the bank the
+        // caller thought it was?
+        final String tenantId = currentTenantId();
+        final String message = tenantId != null ? GENERIC_AUTH_FAILURE + " (tenant: " + tenantId + ")" : GENERIC_AUTH_FAILURE;
+        return jsonError(401, message);
+    }
+
+    private WebApplicationException badRequest(final String message) {
+        return jsonError(400, message);
+    }
+
+    private WebApplicationException notFound(final String message) {
+        return jsonError(404, message);
+    }
+
+    private WebApplicationException jsonError(final int status, final String message) {
+        final String body = "{\"httpStatusCode\":\"" + status + "\",\"message\":\"" + message.replace("\"", "'") + "\"}";
+        return new WebApplicationException(Response.status(status).entity(body).type(MediaType.APPLICATION_JSON).build());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/TenantMenuAccessApiResource.java

@@ -0,0 +1,214 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.apiclient;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonObject;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.fineract.infrastructure.core.domain.FineractPlatformTenant;
+import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
+import org.apache.fineract.infrastructure.core.service.tenant.TenantDetailsService;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Which top-nav menu sections a tenant is allowed to ever show, regardless of what any role inside
+ * that tenant grants itself.
+ *
+ * {@code HasPermissionDirective} on the frontend already hides a menu item a user's own role lacks --
+ * but a role carrying {@code ALL_FUNCTIONS} (a super user, or a role simply misconfigured to hold it,
+ * as the "Clerk" role was found to in two tenants this session) bypasses that check unconditionally.
+ * A bank's own admin screen for roles and permissions therefore cannot be trusted as the only gate on
+ * "does this bank ever get to see the HRM/NPA/Admin section" -- whoever ends up with ALL_FUNCTIONS in
+ * that tenant, today or after some future role edit, would still see it. This table is the ceiling
+ * that check now also has to clear.
+ *
+ * Reading it accepts either credential (see {@link #read} below) -- a bank's own user needs their own
+ * tenant's list to render their nav correctly, the same way they already read their own permissions,
+ * and the platform operator needs to read ANY tenant's current list before toggling it. Writing it
+ * accepts only the platform's own {@code X-Api-Key} + {@link ApiClientCredentialService} credential --
+ * the same mechanism {@code ClientAllAccountsApiResource} uses for third-party callers, but with no
+ * session fallback at all here. That is deliberate -- a bank's own super user must never be able to
+ * lift its own ceiling by granting themselves a permission from inside their own tenant, which is
+ * exactly what a normal {@code ALL_FUNCTIONS} gate would allow. The key is minted once via
+ * {@code POST /v1/apiclients} by the platform operator and never handed to a bank.
+ */
+@Path("/v1/tenant-menu-access")
+@Component
+@Tag(name = "Tenant Menu Access",
+        description = "Per-tenant cap on which top-nav menu sections can ever be shown, independent of any role's own permissions. Read by any logged-in user of the tenant; written only via a platform-operator API key.")
+@RequiredArgsConstructor
+public class TenantMenuAccessApiResource {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final ApiClientCredentialService apiClientCredentialService;
+    private final TenantDetailsService tenantDetailsService;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    private static final String[] IP_HEADER_CANDIDATES = { "X-Forwarded-For", "Proxy-Client-IP", "WL-Proxy-Client-IP" };
+
+    // The whole, fixed set of top-nav menu codes this screen knows about -- see 0541 for how this
+    // list was seeded. A write is only ever a PATCH over this table's existing rows (see save()); a
+    // code outside this set cannot be created by the API, so a typo in a request body is silently a
+    // no-op rather than junk data the frontend would then have to guard against.
+    private static final Set<String> KNOWN_MENU_CODES = Set.of("MENU_INSTITUTION", "SIDEBAR_CFCFRMS", "MENU_TASKS",
+            "MENU_CASHIER", "MENU_CLERK", "MENU_BRANCH_OPS", "MENU_CLEARING", "MENU_DEPOSITS", "MENU_ADVANCES",
+            "MENU_LOAN_ORIGINATION", "MENU_SHARE", "MENU_NPA", "MENU_GENERAL_LEDGER", "MENU_SUB_LEDGER", "MENU_ACCOUNTING",
+            "MENU_CKYC_MGMT", "MENU_INSURANCE", "MENU_DIGITAL", "MENU_HRM", "MENU_ADMIN", "MENU_RBI", "MENU_INVESTMENT",
+            "MENU_REPORTS", "MENU_OTHERS", "MENU_CONFIG_WIZARD", "MENU_CHEQUEBOOK", "MENU_LETTER_MGMT");
+
+    /**
+     * This tenant's own menu-access list, for the tenant named in {@code Fineract-Platform-TenantId}.
+     * Dual-mode read, same posture as {@code ClientAllAccountsApiResource}: an ordinary logged-in
+     * user reads their own tenant's list exactly like they already read their own permission list
+     * (no elevated permission required), or the platform operator reads ANY tenant's list with the
+     * API key, to know the current state before toggling it on their own control screen. Only the
+     * write side ({@link #save}) has no session fallback -- reading configuration is not sensitive,
+     * changing it is.
+     */
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public String read(@HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest) {
+        if (StringUtils.isNotBlank(apiKey)) {
+            apiClientCredentialService.authenticate(apiKey, resolveClientIp(servletRequest));
+        } else {
+            context.authenticatedUser();
+        }
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("SELECT menu_code, enabled FROM m_tenant_menu_access");
+        final JsonArray out = new JsonArray();
+        for (final Map<String, Object> row : rows) {
+            final JsonObject o = new JsonObject();
+            o.addProperty("menuCode", (String) row.get("menu_code"));
+            o.addProperty("enabled", Boolean.TRUE.equals(row.get("enabled")));
+            out.add(o);
+        }
+        return gson.toJson(out);
+    }
+
+    /**
+     * Every tenant configured on this platform, for the operator's own tenant picker -- always the
+     * master list from the tenant-store database, never the one tenant the caller's own
+     * {@code Fineract-Platform-TenantId} header happened to resolve to. That header still has to name
+     * a real tenant for the request to reach this handler at all (see
+     * {@code TenantAwareBasicAuthenticationFilter}); which one is otherwise irrelevant here.
+     */
+    @GET
+    @Path("/tenants")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String listTenants(@HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest) {
+        requireApiKey(apiKey, servletRequest);
+        final JsonArray out = new JsonArray();
+        for (final FineractPlatformTenant tenant : tenantDetailsService.findAllTenants()) {
+            final JsonObject o = new JsonObject();
+            o.addProperty("identifier", tenant.getTenantIdentifier());
+            o.addProperty("name", tenant.getName());
+            out.add(o);
+        }
+        return gson.toJson(out);
+    }
+
+    /**
+     * Sets which menu codes the tenant named in {@code Fineract-Platform-TenantId} may show, from the
+     * operator's own control screen. API key only -- see the class comment for why a normal session,
+     * even a super user's, is never accepted here.
+     *
+     * Body: {@code [{"menuCode": "MENU_HRM", "enabled": false}, ...]}. Only codes already in
+     * {@link #KNOWN_MENU_CODES} are written; anything else in the body is ignored rather than
+     * rejected, so the operator's screen can always send its full known set without first checking
+     * this deployment's exact backend version.
+     */
+    @PUT
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public String save(@HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest,
+            final String body) {
+        requireApiKey(apiKey, servletRequest);
+
+        final JsonArray entries = gson.fromJson(body, JsonArray.class);
+        if (entries == null) {
+            throw apiError(400, "Request body must be a JSON array of {menuCode, enabled}.");
+        }
+        final Set<String> touched = new LinkedHashSet<>();
+        for (final var el : entries) {
+            final JsonObject entry = el.getAsJsonObject();
+            if (!entry.has("menuCode") || entry.get("menuCode").isJsonNull()) {
+                continue;
+            }
+            final String menuCode = entry.get("menuCode").getAsString();
+            if (!KNOWN_MENU_CODES.contains(menuCode)) {
+                continue;
+            }
+            final boolean enabled = entry.has("enabled") && !entry.get("enabled").isJsonNull() && entry.get("enabled").getAsBoolean();
+            jdbcTemplate.update("UPDATE m_tenant_menu_access SET enabled = ? WHERE menu_code = ?", enabled, menuCode);
+            touched.add(menuCode);
+        }
+        final JsonObject res = new JsonObject();
+        res.addProperty("tenant", ThreadLocalContextUtil.getTenant().getTenantIdentifier());
+        res.addProperty("updated", touched.size());
+        return gson.toJson(res);
+    }
+
+    /** No session fallback, unlike every other API-key-capable endpoint in this codebase -- see the class comment. */
+    private void requireApiKey(final String apiKey, final HttpServletRequest servletRequest) {
+        if (StringUtils.isBlank(apiKey)) {
+            throw apiError(403, "This endpoint is only reachable with a platform operator API key.");
+        }
+        apiClientCredentialService.authenticate(apiKey, resolveClientIp(servletRequest));
+    }
+
+    private String resolveClientIp(final HttpServletRequest request) {
+        for (final String header : IP_HEADER_CANDIDATES) {
+            final String value = request.getHeader(header);
+            if (StringUtils.isNotBlank(value)) {
+                return value.split(",")[0].trim();
+            }
+        }
+        return request.getRemoteAddr();
+    }
+
+    private WebApplicationException apiError(final int httpStatus, final String message) {
+        final JsonObject body = new JsonObject();
+        body.addProperty("message", message);
+        body.addProperty("defaultUserMessage", message);
+        body.addProperty("httpStatus", httpStatus);
+        return new WebApplicationException(
+                Response.status(httpStatus).entity(gson.toJson(body)).type(MediaType.APPLICATION_JSON).build());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/organisation/office/api/OfficesApiResource.java

@@ -29,6 +29,7 @@ import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.PUT;
@@ -200,6 +201,20 @@ public class OfficesApiResource {
         return toApiJsonSerializer.serialize(result);
     }
 
+    @DELETE
+    @Path("{officeId}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Delete an Office", description = "Deletes an office outright. Fails if the office still has sub-offices, staff, clients, groups, users, or any other record attached to it.")
+    @ApiResponse(responseCode = "200", description = "OK")
+    public String deleteOffice(@PathParam("officeId") @Parameter(description = "officeId") final Long officeId) {
+        final CommandWrapper commandRequest = new CommandWrapperBuilder() //
+                .deleteOffice(officeId) //
+                .build();
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        return toApiJsonSerializer.serialize(result);
+    }
+
     @PUT
     @Path("/external-id/{externalId}")
     @Consumes({ MediaType.APPLICATION_JSON })

fineract-provider/src/main/java/org/apache/fineract/organisation/office/handler/DeleteOfficeCommandHandler.java

@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.organisation.office.handler;
+
+import org.apache.fineract.commands.annotation.CommandType;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.organisation.office.service.OfficeWritePlatformService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@CommandType(entity = "OFFICE", action = "DELETE")
+public class DeleteOfficeCommandHandler implements NewCommandSourceHandler {
+
+    private final OfficeWritePlatformService writePlatformService;
+
+    @Autowired
+    public DeleteOfficeCommandHandler(final OfficeWritePlatformService writePlatformService) {
+        this.writePlatformService = writePlatformService;
+    }
+
+    @Transactional
+    @Override
+    public CommandProcessingResult processCommand(final JsonCommand command) {
+
+        return this.writePlatformService.deleteOffice(command.entityId(), command);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/organisation/office/service/OfficeWritePlatformService.java

@@ -27,6 +27,8 @@ public interface OfficeWritePlatformService {
 
     CommandProcessingResult updateOffice(Long officeId, JsonCommand command);
 
+    CommandProcessingResult deleteOffice(Long officeId, JsonCommand command);
+
     CommandProcessingResult officeTransaction(JsonCommand command);
 
     CommandProcessingResult deleteOfficeTransaction(Long id, JsonCommand command);

fineract-provider/src/main/java/org/apache/fineract/organisation/office/service/OfficeWritePlatformServiceJpaRepositoryImpl.java

@@ -44,6 +44,7 @@ import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.Caching;
 import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.orm.jpa.JpaSystemException;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -57,6 +58,13 @@ public class OfficeWritePlatformServiceJpaRepositoryImpl implements OfficeWriteP
     private final OfficeRepositoryWrapper officeRepositoryWrapper;
     private final OfficeTransactionRepository officeTransactionRepository;
     private final ApplicationCurrencyRepositoryWrapper applicationCurrencyRepository;
+    // Lightweight existence checks ahead of delete -- m_office has ~30 tables with a foreign key back
+    // to it (clients, staff, GL entries, tellers, cheque stock, current accounts, ...); pulling in a
+    // repository for every one of them just to count rows would be a lot of new wiring for a check
+    // that is fundamentally "does anything point at this row". A handful of raw counts up front cover
+    // the cases a user can actually resolve themselves (move the clients, reassign the staff); the
+    // long tail that is left is caught by the try/catch around the delete itself.
+    private final JdbcTemplate jdbcTemplate;
 
     @Transactional
     @Override
@@ -147,6 +155,73 @@ public class OfficeWritePlatformServiceJpaRepositoryImpl implements OfficeWriteP
         }
     }
 
+    /**
+     * Deletes an office outright -- distinct from every other office command, which only ever changes
+     * status or fields. There is no "closed" state for an office the way there is for a client or a
+     * savings account, and no command handler ever implemented this, so the UI's "Remove" action always
+     * failed with a generic error no matter how empty the office was; the endpoint it called never
+     * existed.
+     *
+     * Checked up front, in the order a user could actually act on them: sub-offices first (the deepest
+     * structural block), then staff, clients and groups (the day-to-day reason an office still has
+     * anything in it), then any AppUser still homed there. Everything else that references m_office --
+     * GL journal entries, teller cash positions, cheque stock, current accounts, loan/savings
+     * transactions, and more -- is not spelled out here one table at a time; a real foreign-key
+     * violation on the delete itself is caught below and turned into one clear message instead. An
+     * office with real banking history behind it is not something this should make easy to remove either
+     * way, checked up front or not.
+     */
+    @Transactional
+    @Override
+    @Caching(evict = {
+            @CacheEvict(value = "offices", key = "T(org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil).getTenant().getTenantIdentifier().concat(#root.target.context.authenticatedUser().getOffice().getHierarchy()+'of')"),
+            @CacheEvict(value = "officesForDropdown", key = "T(org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil).getTenant().getTenantIdentifier().concat(#root.target.context.authenticatedUser().getOffice().getHierarchy()+'ofd')"),
+            @CacheEvict(value = "officesById", key = "T(org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil).getTenant().getTenantIdentifier().concat(#officeId)") })
+    public CommandProcessingResult deleteOffice(final Long officeId, final JsonCommand command) {
+
+        this.context.authenticatedUser();
+
+        final Office office = this.officeRepositoryWrapper.findOneWithNotFoundDetection(officeId);
+
+        requireNoneReference(officeId, "m_office", "parent_id", "sub-office", "sub-offices",
+                "Move or remove its sub-offices before deleting this office.");
+        requireNoneReference(officeId, "m_staff", "office_id", "staff member", "staff members",
+                "Reassign its staff to another office before deleting this office.");
+        requireNoneReference(officeId, "m_client", "office_id", "client", "clients",
+                "Transfer its clients to another office before deleting this office.");
+        requireNoneReference(officeId, "m_group", "office_id", "group", "groups",
+                "Transfer its groups to another office before deleting this office.");
+        requireNoneReference(officeId, "m_appuser", "office_id", "user", "users",
+                "Reassign the users homed at this office before deleting it.");
+
+        try {
+            this.officeRepositoryWrapper.deleteAndFlush(office);
+        } catch (final JpaSystemException | DataIntegrityViolationException dve) {
+            throw ErrorHandler.getMappable(dve, "error.msg.office.cannot.delete.has.references",
+                    "This office cannot be deleted: other records (accounts, transactions or history) still reference it.");
+        } catch (final PersistenceException dve) {
+            throw ErrorHandler.getMappable(dve, "error.msg.office.cannot.delete.has.references",
+                    "This office cannot be deleted: other records (accounts, transactions or history) still reference it.");
+        }
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .withEntityId(officeId) //
+                .withOfficeId(officeId) //
+                .build();
+    }
+
+    private void requireNoneReference(final Long officeId, final String table, final String column, final String singular,
+            final String plural, final String remedy) {
+        final Long count = this.jdbcTemplate.queryForObject("SELECT COUNT(*) FROM " + table + " WHERE " + column + " = ?", Long.class,
+                officeId);
+        if (count != null && count > 0) {
+            final String noun = count == 1 ? singular : plural;
+            throw new PlatformDataIntegrityException("error.msg.office.cannot.delete.still.referenced",
+                    "Office cannot be deleted: it has " + count + " " + noun + " attached. " + remedy, "officeId", officeId);
+        }
+    }
+
     @Transactional
     @Override
     public CommandProcessingResult officeTransaction(final JsonCommand command) {

fineract-provider/src/main/java/org/apache/fineract/organisation/office/starter/OrganisationOfficeConfiguration.java

@@ -56,9 +56,9 @@ public class OrganisationOfficeConfiguration {
             OfficeCommandFromApiJsonDeserializer fromApiJsonDeserializer,
             OfficeTransactionCommandFromApiJsonDeserializer moneyTransferCommandFromApiJsonDeserializer,
             OfficeRepositoryWrapper officeRepositoryWrapper, OfficeTransactionRepository officeTransactionRepository,
-            ApplicationCurrencyRepositoryWrapper applicationCurrencyRepository) {
+            ApplicationCurrencyRepositoryWrapper applicationCurrencyRepository, JdbcTemplate jdbcTemplate) {
         return new OfficeWritePlatformServiceJpaRepositoryImpl(context, fromApiJsonDeserializer,
                 moneyTransferCommandFromApiJsonDeserializer, officeRepositoryWrapper, officeTransactionRepository,
-                applicationCurrencyRepository);
+                applicationCurrencyRepository, jdbcTemplate);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/accountdetails/service/AccountDetailsReadPlatformServiceJpaRepositoryImpl.java

@@ -357,9 +357,14 @@ public class AccountDetailsReadPlatformServiceJpaRepositoryImpl implements Accou
             accountsSummary.append("curr.name as currencyName, curr.internationalized_name_code as currencyNameCode, ");
             accountsSummary.append("curr.display_symbol as currencyDisplaySymbol, ");
             accountsSummary.append("sa.product_id as productId, p.name as productName, p.short_name as shortProductName, ");
-            accountsSummary.append("sa.deposit_type_enum as depositType ");
+            accountsSummary.append("sa.deposit_type_enum as depositType, ");
+            // Renewal-chain identity for Fixed Deposits: the stable customer-facing FD number and
+            // this row's cycle within the chain, so a client's account list can collapse a renewed
+            // FD into one entry rather than listing every term as a separate account.
+            accountsSummary.append("dtp.fd_account_number as fdAccountNumber, dtp.renewal_cycle_no as renewalCycleNo ");
             accountsSummary.append("from m_savings_account sa ");
             accountsSummary.append("join m_savings_product as p on p.id = sa.product_id ");
+            accountsSummary.append("left join m_deposit_account_term_and_preclosure dtp on dtp.savings_account_id = sa.id ");
             accountsSummary.append("join m_currency curr on curr.code = sa.currency_code ");
             accountsSummary.append("left join m_appuser sbu on sbu.id = sa.submittedon_userid ");
             accountsSummary.append("left join m_appuser rbu on rbu.id = sa.rejectedon_userid ");
@@ -453,9 +458,15 @@ public class AccountDetailsReadPlatformServiceJpaRepositoryImpl implements Accou
                     approvedByUsername, approvedByFirstname, approvedByLastname, activatedOnDate, activatedByUsername, activatedByFirstname,
                     activatedByLastname, closedOnDate, closedByUsername, closedByFirstname, closedByLastname);
 
+            // Null for a savings/current account and for an FD opened before this column existed;
+            // callers fall back to accountNo, so an FD that has never been renewed still reads as
+            // its own FD number.
+            final String fdAccountNumber = rs.getString("fdAccountNumber");
+            final Integer renewalCycleNo = JdbcSupport.getInteger(rs, "renewalCycleNo");
+
             return new SavingsAccountSummaryData(id, accountNo, externalId, productId, productName, shortProductName, status, currency,
                     accountBalance, onHoldFunds, onHoldAmount, availableBalance, accountTypeData, timeline, depositTypeData, subStatus,
-                    lastActiveTransactionDate);
+                    lastActiveTransactionDate, fdAccountNumber, renewalCycleNo);
         }
     }
 
@@ -567,8 +578,10 @@ public class AccountDetailsReadPlatformServiceJpaRepositoryImpl implements Accou
 
             final EnumOptionData depositTypeData = SavingsEnumerations.depositType(400);
 
+            // Current accounts have no deposit term, so no FD renewal chain to report.
             return new SavingsAccountSummaryData(id, accountNo, externalId, productId, productName, shortProductName, status, currency,
-                    accountBalance, onHoldFunds, null, accountBalance, accountTypeData, timeline, depositTypeData, subStatus, activatedOnDate);
+                    accountBalance, onHoldFunds, null, accountBalance, accountTypeData, timeline, depositTypeData, subStatus, activatedOnDate,
+                    null, null);
         }
     }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/accountregister/api/AccountRegisterApiResource.java

@@ -0,0 +1,299 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.accountregister.api;
+
+import com.google.gson.Gson;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import java.math.BigDecimal;
+import java.sql.Date;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Account register for one date: which accounts were opened and which were closed that day, with
+ * each account's balance as it stood on that date alongside what it holds now.
+ *
+ * The dated balance is read from the running balance stamped on the last transaction up to that
+ * date, rather than recomputed from the account's current figure — a current balance tells you
+ * nothing about what the account held three weeks ago.
+ */
+@Path("/v1/accountregister")
+@Component
+@RequiredArgsConstructor
+@Produces({ MediaType.APPLICATION_JSON })
+public class AccountRegisterApiResource {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final Gson gson = new Gson();
+
+    @GET
+    public String register(@QueryParam("date") final String dateParam, @QueryParam("section") final String section) {
+        this.context.authenticatedUser();
+
+        final LocalDate asOn;
+        if (dateParam != null && !dateParam.isBlank()) {
+            try {
+                asOn = LocalDate.parse(dateParam);
+            } catch (final java.time.format.DateTimeParseException e) {
+                throw new PlatformDataIntegrityException("error.msg.accountregister.date.invalid",
+                        "Date must be in yyyy-MM-dd format.");
+            }
+        } else {
+            asOn = LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
+        }
+
+        final String want = section == null || section.isBlank() ? "ALL" : section.toUpperCase();
+        final List<Map<String, Object>> rows = new ArrayList<>();
+
+        if (matches(want, "SAVINGS") || matches(want, "FD") || matches(want, "RD")) {
+            rows.addAll(depositAccounts(asOn, want));
+        }
+        if (matches(want, "SHARE")) {
+            rows.addAll(shareAccounts(asOn));
+        }
+
+        // Opened and closed counts come from the rows themselves rather than separate COUNT queries,
+        // so the totals can never disagree with the list they summarise.
+        int opened = 0;
+        int closed = 0;
+        BigDecimal balanceOnDate = BigDecimal.ZERO;
+        BigDecimal currentBalance = BigDecimal.ZERO;
+        for (final Map<String, Object> r : rows) {
+            if (Boolean.TRUE.equals(r.get("openedOnDate"))) {
+                opened++;
+            }
+            if (Boolean.TRUE.equals(r.get("closedOnDate"))) {
+                closed++;
+            }
+            balanceOnDate = balanceOnDate.add(dec(r.get("balanceOnDate")));
+            currentBalance = currentBalance.add(dec(r.get("currentBalance")));
+        }
+
+        final Map<String, Object> out = new LinkedHashMap<>();
+        out.put("date", asOn.toString());
+        out.put("section", want);
+        out.put("accounts", rows);
+        out.put("count", rows.size());
+        out.put("openedCount", opened);
+        out.put("closedCount", closed);
+        out.put("totalBalanceOnDate", balanceOnDate);
+        out.put("totalCurrentBalance", currentBalance);
+        return gson.toJson(out);
+    }
+
+    private static boolean matches(final String want, final String section) {
+        return "ALL".equals(want) || want.equals(section);
+    }
+
+    private static BigDecimal dec(final Object o) {
+        return o instanceof BigDecimal b ? b : BigDecimal.ZERO;
+    }
+
+    /**
+     * Savings, fixed and recurring deposit accounts. All three live in m_savings_account, told
+     * apart by deposit_type_enum: 100 savings, 200 fixed, 300 recurring.
+     *
+     * Accounts submitted after the date are excluded — on that date they did not exist, and listing
+     * them would make a register of a past day describe a present one.
+     */
+    private List<Map<String, Object>> depositAccounts(final LocalDate asOn, final String want) {
+        final Date date = Date.valueOf(asOn);
+
+        final StringBuilder typeFilter = new StringBuilder();
+        if (!"ALL".equals(want)) {
+            final int type = switch (want) {
+                case "SAVINGS" -> 100;
+                case "FD" -> 200;
+                case "RD" -> 300;
+                default -> 0;
+            };
+            if (type > 0) {
+                typeFilter.append(" AND sa.deposit_type_enum = ").append(type);
+            }
+        }
+
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT sa.id, sa.account_no, sa.deposit_type_enum, sa.status_enum,
+                       sa.activatedon_date, sa.closedon_date, sa.submittedon_date,
+                       sa.account_balance_derived,
+                       c.display_name AS client_name,
+                       p.name AS product_name,
+                       (SELECT t.running_balance_derived
+                          FROM m_savings_account_transaction t
+                         WHERE t.savings_account_id = sa.id
+                           AND COALESCE(t.is_reversed, false) = false
+                           AND t.transaction_date <= ?
+                         ORDER BY t.transaction_date DESC, t.id DESC
+                         LIMIT 1) AS balance_on_date
+                  FROM m_savings_account sa
+                  LEFT JOIN m_client c ON c.id = sa.client_id
+                  LEFT JOIN m_savings_product p ON p.id = sa.product_id
+                 WHERE (sa.submittedon_date IS NULL OR sa.submittedon_date <= ?)
+                """ + typeFilter + """
+                 ORDER BY sa.deposit_type_enum, sa.account_no
+                """, date, date);
+
+        final List<Map<String, Object>> out = new ArrayList<>();
+        for (final Map<String, Object> r : rows) {
+            final Map<String, Object> m = new LinkedHashMap<>();
+            final int depositType = num(r.get("deposit_type_enum"));
+            m.put("accountId", r.get("id"));
+            m.put("accountNo", r.get("account_no"));
+            m.put("section", depositType == 200 ? "FD" : depositType == 300 ? "RD" : "SAVINGS");
+            m.put("clientName", r.get("client_name"));
+            m.put("productName", r.get("product_name"));
+            m.put("status", savingsStatus(num(r.get("status_enum"))));
+            m.put("openedOn", str(r.get("activatedon_date")));
+            m.put("closedOn", str(r.get("closedon_date")));
+            m.put("openedOnDate", sameDay(r.get("activatedon_date"), asOn));
+            m.put("closedOnDate", sameDay(r.get("closedon_date"), asOn));
+            // No transaction up to that date means the account had nothing in it yet, not that the
+            // balance is unknown.
+            m.put("balanceOnDate", r.get("balance_on_date") == null ? BigDecimal.ZERO : r.get("balance_on_date"));
+            m.put("currentBalance", r.get("account_balance_derived") == null
+                    ? BigDecimal.ZERO : r.get("account_balance_derived"));
+            out.add(m);
+        }
+        return out;
+    }
+
+    /**
+     * Share accounts. Their transactions carry no running balance the way savings ones do, but they
+     * are individually dated, so the holding on a given date is the shares purchased up to that
+     * date less those redeemed — which is a real dated figure, not the current one relabelled.
+     */
+    private List<Map<String, Object>> shareAccounts(final LocalDate asOn) {
+        final Date date = Date.valueOf(asOn);
+
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT sa.id, sa.account_no, sa.status_enum, sa.activated_date, sa.closed_date,
+                       sa.total_approved_shares,
+                       c.display_name AS client_name,
+                       p.name AS product_name,
+                       (SELECT COALESCE(SUM(CASE WHEN t.type_enum = 500 THEN t.total_shares * t.unit_price
+                                                 WHEN t.type_enum = 600 THEN -(t.total_shares * t.unit_price)
+                                                 ELSE 0 END), 0)
+                          FROM m_share_account_transactions t
+                         WHERE t.account_id = sa.id AND t.is_active = true
+                           AND t.status_enum = 300
+                           AND t.type_enum IN (500, 600)) AS share_value,
+                       -- Purchases less redemptions dated on or before the register's date. Charge
+                       -- rows (type 700) are excluded: an entry fee is not share capital. Only
+                       -- approved purchases count (status 300) — a rejected application leaves its
+                       -- row behind still flagged active, and counting it credited a member with
+                       -- shares they were never issued.
+                       (SELECT COALESCE(SUM(CASE WHEN t.type_enum = 500 THEN t.total_shares * t.unit_price
+                                                 WHEN t.type_enum = 600 THEN -(t.total_shares * t.unit_price)
+                                                 ELSE 0 END), 0)
+                          FROM m_share_account_transactions t
+                         WHERE t.account_id = sa.id AND t.is_active = true
+                           AND t.status_enum = 300
+                           AND t.type_enum IN (500, 600)
+                           AND t.transaction_date <= ?) AS value_on_date,
+                       (SELECT COALESCE(SUM(CASE WHEN t.type_enum = 500 THEN t.total_shares
+                                                 WHEN t.type_enum = 600 THEN -t.total_shares
+                                                 ELSE 0 END), 0)
+                          FROM m_share_account_transactions t
+                         WHERE t.account_id = sa.id AND t.is_active = true
+                           AND t.status_enum = 300
+                           AND t.type_enum IN (500, 600)
+                           AND t.transaction_date <= ?) AS shares_on_date
+                  FROM m_share_account sa
+                  LEFT JOIN m_client c ON c.id = sa.client_id
+                  LEFT JOIN m_share_product p ON p.id = sa.product_id
+                 WHERE (sa.submitted_date IS NULL OR sa.submitted_date <= ?)
+                 ORDER BY sa.account_no
+                """, date, date, date);
+
+        final List<Map<String, Object>> out = new ArrayList<>();
+        for (final Map<String, Object> r : rows) {
+            final Map<String, Object> m = new LinkedHashMap<>();
+            m.put("accountId", r.get("id"));
+            m.put("accountNo", r.get("account_no"));
+            m.put("section", "SHARE");
+            m.put("clientName", r.get("client_name"));
+            m.put("productName", r.get("product_name"));
+            m.put("status", shareStatus(num(r.get("status_enum"))));
+            m.put("openedOn", str(r.get("activated_date")));
+            m.put("closedOn", str(r.get("closed_date")));
+            m.put("openedOnDate", sameDay(r.get("activated_date"), asOn));
+            m.put("closedOnDate", sameDay(r.get("closed_date"), asOn));
+            m.put("balanceOnDate", r.get("value_on_date") == null ? BigDecimal.ZERO : r.get("value_on_date"));
+            m.put("currentBalance", r.get("share_value") == null ? BigDecimal.ZERO : r.get("share_value"));
+            // Shares as at the date, not the approved figure — an account can hold fewer than were
+            // approved once some have been redeemed.
+            m.put("sharesHeld", r.get("shares_on_date"));
+            out.add(m);
+        }
+        return out;
+    }
+
+    private static boolean sameDay(final Object dbDate, final LocalDate asOn) {
+        return dbDate != null && asOn.toString().equals(dbDate.toString());
+    }
+
+    private static String str(final Object o) {
+        return o == null ? null : o.toString();
+    }
+
+    private static int num(final Object o) {
+        return o instanceof Number n ? n.intValue() : 0;
+    }
+
+    private static String savingsStatus(final int status) {
+        return switch (status) {
+            case 100 -> "SUBMITTED";
+            case 200 -> "APPROVED";
+            case 300 -> "ACTIVE";
+            case 400 -> "WITHDRAWN";
+            case 500 -> "REJECTED";
+            case 600 -> "CLOSED";
+            case 700 -> "TRANSFER IN PROGRESS";
+            case 800 -> "TRANSFER ON HOLD";
+            case 900 -> "PREMATURELY CLOSED";
+            default -> "UNKNOWN";
+        };
+    }
+
+    private static String shareStatus(final int status) {
+        return switch (status) {
+            case 100 -> "SUBMITTED";
+            case 200 -> "APPROVED";
+            case 300 -> "ACTIVE";
+            case 400 -> "WITHDRAWN";
+            case 500 -> "REJECTED";
+            case 600 -> "CLOSED";
+            default -> "UNKNOWN";
+        };
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/accounts/constants/ShareAccountApiConstants.java

@@ -61,6 +61,8 @@ public interface ShareAccountApiConstants {
     String externalid_paramname = "externalId";
 
     String resolutionnumber_paramname = "resolutionNumber";
+    /** Date of the board meeting that passed the resolution. */
+    String resolutiondate_paramname = "resolutionDate";
 
     String currency_paramname = "currencyCode";
 
@@ -113,9 +115,40 @@ public interface ShareAccountApiConstants {
      *  outstanding balance. */
     String linkedloanid_paramname = "linkedLoanId";
 
+    /**
+     * Where the money for an additional-share tranche comes from — {@code CASH} or {@code SAVINGS}.
+     *
+     * Both routes leave the money in the Share Sundry (SHARES_SUSPENSE) holding account, so
+     * approving the tranche posts the same Dr Sundry / Cr Share Capital pair either way. They
+     * differ only in how it got there: CASH means the cashier already took it at the counter
+     * against a voucher, SAVINGS means the member's own savings account is debited on submit.
+     */
+    String fundingsource_paramname = "fundingSource";
+
+    String FUNDING_SOURCE_CASH = "CASH";
+
+    String FUNDING_SOURCE_SAVINGS = "SAVINGS";
+
+    /**
+     * The Share Sundry receipt funding a CASH tranche, from {@code m_share_advance_collection}.
+     *
+     * Recorded against the tranche so one voucher cannot be spent twice, and so the approver can
+     * see which receipt the money they are releasing came in on.
+     */
+    String advancecollectionid_paramname = "advanceCollectionId";
+
+    /**
+     * The remaining vouchers funding a CASH tranche, when one receipt does not cover it.
+     *
+     * A member paying in instalments — ₹600 today, the ₹400 balance tomorrow — has several receipts
+     * against one request. The first leads in {@link #advancecollectionid_paramname}; these are the
+     * rest, and their combined total is what has to cover the shares.
+     */
+    String additionalcollectionids_paramname = "additionalCollectionIds";
+
     Set<String> supportedParameters = Collections.unmodifiableSet(new HashSet<>(Arrays.asList(locale_paramname, dateformat_paramname,
             id_paramname, clientid_paramname, productid_paramname, submitteddate_paramname, approveddate_paramname, externalid_paramname,
-            resolutionnumber_paramname, currency_paramname, digitsafterdecimal_paramname, inmultiplesof_paramname,
+            resolutionnumber_paramname, resolutiondate_paramname, currency_paramname, digitsafterdecimal_paramname, inmultiplesof_paramname,
             requestedshares_paramname, savingsaccountid_paramname, lockinperiod_paramname, lockperiodfrequencytype_paramname,
             minimumactiveperiod_paramname, minimumactiveperiodfrequencytype_paramname,
             allowdividendcalculationforinactiveclients_paramname, charges_paramname, applicationdate_param, purchaseddate_paramname,

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AlertReviewRequest.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.aml.api;
 
+import java.util.List;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
@@ -30,4 +31,13 @@ public class AlertReviewRequest {
 
     private String disposition;
     private String notes;
+
+    /**
+     * The rules being decided, when the officer is deciding some of them rather than the whole alert.
+     *
+     * <p>
+     * Absent or empty means the decision covers the transaction and every rule it matched, which is what the row-level
+     * Whitelist and Suspicious buttons send and what this endpoint has always done.
+     */
+    private List<String> ruleCodes;
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlAlertApiResource.java

@@ -71,7 +71,13 @@ public class AmlAlertApiResource {
             description = "disposition WHITELIST closes the alert as a false positive; ESCALATE creates an STR case for Principal Officer review.")
     public String review(@PathParam("alertId") final Long alertId, final AlertReviewRequest request) {
         this.context.authenticatedUser().validateHasPermissionTo("REVIEW_AML_ALERT");
-        if ("ESCALATE".equalsIgnoreCase(request.getDisposition())) {
+        final boolean escalating = "ESCALATE".equalsIgnoreCase(request.getDisposition());
+        if (request.getRuleCodes() != null && !request.getRuleCodes().isEmpty()) {
+            // Deciding named rules within the alert. The alert's own status follows from what is left undecided, so
+            // it is not set here.
+            this.writePlatformService.reviewRules(alertId, request.getRuleCodes(), escalating ? "ESCALATE" : "WHITELIST",
+                    request.getNotes());
+        } else if (escalating) {
             this.writePlatformService.escalate(alertId, request.getNotes());
         } else {
             this.writePlatformService.whitelist(alertId, request.getNotes());

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlCtrReportApiResource.java

@@ -25,6 +25,7 @@ import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import java.time.YearMonth;
 import java.util.List;
@@ -32,6 +33,7 @@ import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.aml.data.AmlCtrReportData;
+import org.apache.fineract.portfolio.aml.data.AmlCtrReportLineData;
 import org.apache.fineract.portfolio.aml.service.AmlCtrReportGenerationService;
 import org.apache.fineract.portfolio.aml.service.AmlCtrReportReadPlatformService;
 import org.springframework.stereotype.Component;
@@ -47,6 +49,7 @@ public class AmlCtrReportApiResource {
     private final AmlCtrReportReadPlatformService readPlatformService;
     private final AmlCtrReportGenerationService generationService;
     private final DefaultToApiJsonSerializer<AmlCtrReportData> toApiJsonSerializer;
+    private final DefaultToApiJsonSerializer<AmlCtrReportLineData> lineJsonSerializer;
 
     @GET
     @Consumes({ MediaType.APPLICATION_JSON })
@@ -58,6 +61,28 @@ public class AmlCtrReportApiResource {
         return this.toApiJsonSerializer.serialize(reports);
     }
 
+    @GET
+    @Path("lines")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "The reportable lines behind the generated CTRs",
+            description = "Each line resolved to the account, customer, branch and date a FIU-IND filing names. Optional reportId narrows it to one month.")
+    public String retrieveLines(@QueryParam("reportId") final Long reportId) {
+        this.context.authenticatedUser();
+        return this.lineJsonSerializer.serialize(this.readPlatformService.retrieveLines(reportId));
+    }
+
+    @GET
+    @Path("pending-lines")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Reportable cash transactions not yet in any generated CTR",
+            description = "The monthly batch is a snapshot, so a transaction posted after it ran belongs to that month's filing but sits in no report. These are those transactions, shaped as lines, so a reportable one is never invisible.")
+    public String retrievePendingLines() {
+        this.context.authenticatedUser();
+        return this.lineJsonSerializer.serialize(this.readPlatformService.retrievePendingLines());
+    }
+
     @POST
     @Path("generate")
     @Consumes({ MediaType.APPLICATION_JSON })

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/ClientRiskChangeApiResource.java

@@ -0,0 +1,172 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonObject;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.function.Supplier;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.service.ClientRiskChangeRequestService;
+import org.springframework.stereotype.Component;
+
+/**
+ * Moving a customer's KYC risk category, under maker-checker.
+ *
+ * <p>
+ * Raised from the Risk Review Report, which already works out which customers are rated below what
+ * their behaviour warrants. The rating moves only when a checker approves, and the change is written
+ * into the customer's risk history with the reason given.
+ */
+@Path("/v1/aml/risk-change-requests")
+@Component
+@Tag(name = "Client Risk Category Change",
+        description = "Maker-checker changes to a customer's KYC risk category, raised from the Risk Review Report.")
+@RequiredArgsConstructor
+public class ClientRiskChangeApiResource {
+
+    private final PlatformSecurityContext context;
+    private final ClientRiskChangeRequestService service;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    /**
+     * Business-rule failures in this module are plain IllegalArgument/IllegalState exceptions, which
+     * Fineract's global handler does not map - left uncaught they reach the client as an opaque 500
+     * with no message. Wrapped so the reviewer is told what actually stopped them.
+     */
+    private <T> T safely(final Supplier<T> action) {
+        try {
+            return action.get();
+        } catch (final IllegalArgumentException | IllegalStateException e) {
+            throw apiError(400, e.getMessage());
+        }
+    }
+
+    private WebApplicationException apiError(final int httpStatus, final String message) {
+        final JsonObject body = new JsonObject();
+        body.addProperty("message", message);
+        body.addProperty("defaultUserMessage", message);
+        body.addProperty("httpStatus", httpStatus);
+        final JsonArray errors = new JsonArray();
+        final JsonObject err = new JsonObject();
+        err.addProperty("defaultUserMessage", message);
+        errors.add(err);
+        body.add("errors", errors);
+        return new WebApplicationException(
+                Response.status(httpStatus).entity(this.gson.toJson(body)).type(MediaType.APPLICATION_JSON).build());
+    }
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List risk category change requests",
+            description = "Optionally filtered by status (PENDING/APPROVED/REJECTED) for the approval queue.")
+    public String retrieveAll(@QueryParam("status") final String status) {
+        this.context.authenticatedUser();
+        return this.gson.toJson(this.service.retrieveAll(status));
+    }
+
+    @POST
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Request a change to a customer's risk category",
+            description = "Maker step. Nothing moves until a checker approves.")
+    public CommandProcessingResult request(final RiskChangeRequest request) {
+        return safely(() -> this.service.request(request.getClientId(), request.getRequestedCategory(), request.getReason()));
+    }
+
+    @POST
+    @Path("{requestId}/approve")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Approve a risk category change",
+            description = "Checker step: applies the new category to the customer's KYC record, moves the re-KYC due date onto that category's cycle, and writes the change into the risk history.")
+    public CommandProcessingResult approve(@PathParam("requestId") final Long requestId) {
+        return safely(() -> this.service.approve(requestId));
+    }
+
+    @POST
+    @Path("{requestId}/reject")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Reject a risk category change", description = "Checker step. The customer's rating is left as it is.")
+    public CommandProcessingResult reject(@PathParam("requestId") final Long requestId, final RiskChangeRejectRequest request) {
+        return safely(() -> this.service.reject(requestId, request.getRejectionReason()));
+    }
+
+    /** Request bodies. Plain beans so Jackson binds them without a serializer of their own. */
+    public static final class RiskChangeRequest {
+
+        private Long clientId;
+        private Integer requestedCategory;
+        private String reason;
+
+        public Long getClientId() {
+            return clientId;
+        }
+
+        public void setClientId(Long clientId) {
+            this.clientId = clientId;
+        }
+
+        public Integer getRequestedCategory() {
+            return requestedCategory;
+        }
+
+        public void setRequestedCategory(Integer requestedCategory) {
+            this.requestedCategory = requestedCategory;
+        }
+
+        public String getReason() {
+            return reason;
+        }
+
+        public void setReason(String reason) {
+            this.reason = reason;
+        }
+    }
+
+    public static final class RiskChangeRejectRequest {
+
+        private String rejectionReason;
+
+        public String getRejectionReason() {
+            return rejectionReason;
+        }
+
+        public void setRejectionReason(String rejectionReason) {
+            this.rejectionReason = rejectionReason;
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlAlertData.java

@@ -30,6 +30,16 @@ import java.time.LocalDateTime;
  */
 public record AmlAlertData(Long id, String transactionType, Long transactionId, Long clientId, String clientDisplayName,
         String ruleCode, String ruleDescription, BigDecimal amount, String currencyCode, LocalDateTime raisedOn, String status,
-        String reviewedByUsername, LocalDateTime reviewedOn, String reviewNotes, String disposition, Integer riskCategory)
+        String reviewedByUsername, LocalDateTime reviewedOn, String reviewNotes, String disposition, Integer riskCategory,
+        /** Other rules the same transaction matched, comma-separated. Null when only one fired. */
+        String alsoMatchedRules,
+        /** Worst severity across every rule the transaction matched, not only the governing one. */
+        Integer highestSeverity,
+        /**
+         * Every rule the transaction matched, governing one first, each with its description and severity. The
+         * comma-separated {@code alsoMatchedRules} is kept for what already reads it; this is what the screen expands
+         * to show, because a bare rule code does not tell an officer what was detected or how serious it is.
+         */
+        java.util.List<AmlMatchedRuleData> matchedRules)
         implements Serializable {
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlCtrReportLineData.java

@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+
+/**
+ * One reportable line of a monthly CTR, carrying what the FIU-IND submission actually needs rather
+ * than only the ids the line is stored under.
+ *
+ * <p>
+ * The stored line keeps a client id and a transaction id; a filing needs the account, the customer,
+ * the branch and the date those ids stand for. They are joined here so the screen and the CSV are
+ * built from the report the bank generated, not from a second calculation that could disagree with
+ * it.
+ *
+ * <p>
+ * A connected-group line has no single transaction behind it - it is a month's worth of smaller
+ * cash movements by one customer that together cross the threshold - so its transaction id, account
+ * and date are null, and {@code connectedGroup} says why.
+ */
+public record AmlCtrReportLineData(Long id, Long reportId, String reportMonth, String transactionType, Long transactionId,
+        Long clientId, String clientName, String accountNo, String branchName, LocalDate transactionDate, String direction,
+        BigDecimal amount, boolean connectedGroup,
+        /**
+         * Account facts the Account_Detail file reports. They were being filled in with a constant
+         * opening date of 20/05/2018 and a status of ACTIVE for every row, which is a statement
+         * about the customer's account that nobody had checked.
+         */
+        LocalDate accountOpenedOn, LocalDate accountClosedOn, String accountStatus,
+        /** Customer identifiers the Account_Person_Relation file reports. */
+        String ckycNumber, String clientExternalId, boolean individual) implements Serializable {}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlDirection.java

@@ -0,0 +1,45 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+/**
+ * Which way the money moved, for rules written about one direction only.
+ *
+ * <p>
+ * Without this every rule was matched on amount alone, so a ₹12,00,000 deposit raised
+ * "Frequent low cash WITHDRAWAL" alongside the genuine CTR hit — nine of the ten alerts on that one
+ * transaction were of that kind, and an analyst reading them cannot tell which one is real.
+ */
+public enum AmlDirection {
+
+    /** Money into the customer's account: a deposit, or a loan disbursal. */
+    CREDIT,
+    /** Money out of it: a withdrawal, or a loan repayment. */
+    DEBIT,
+    /** Not established — the rule's own direction filter, if it has one, then does not apply. */
+    UNKNOWN;
+
+    public boolean isCredit() {
+        return this == CREDIT;
+    }
+
+    public boolean isDebit() {
+        return this == DEBIT;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlMatchedRuleData.java

@@ -0,0 +1,43 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+
+/**
+ * One rule a transaction matched, as the alert screen needs to show it.
+ *
+ * <p>
+ * An alert names only the rule it was raised under; the rest were a comma-separated list of codes and nothing more. An
+ * officer deciding what to do with a transaction has to know what each of those codes means and how serious it is -
+ * "NEW_ACCOUNT_HIGH_VALUE_TXN" says nothing on its own, and whether it is Medium or High changes the decision.
+ *
+ * @param governing
+ *            whether this is the rule the alert was raised under. One transaction raises one alert, under whichever
+ *            rule most warrants attention, so exactly one entry in the list carries this.
+ * @param riskCategory
+ *            1 Low, 2 Medium, 3 High. Null for a rule with no catalog ancestor - the CTR rules are statutory returns
+ *            rather than graded suspicions, so they carry no band.
+ */
+public record AmlMatchedRuleData(String ruleCode, String ruleDescription, Integer riskCategory, boolean governing,
+        /** WHITELIST, ESCALATE, or null while this rule is still open. */
+        String disposition, String reviewedByUsername, String reviewNotes,
+        /** True where the officer named this rule; false where it was closed alongside one they named. */
+        boolean directlyDecided) implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlSubjectScope.java

@@ -0,0 +1,64 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+/**
+ * The kind of customer a rule is written about, for rules whose subject is the customer rather than
+ * the transaction.
+ *
+ * <p>
+ * Rules like "PEP account monitoring" and "charitable organisation cash withdrawal" name the entity
+ * in their own title, but nothing checked it: each was matched on amount alone and so fired on every
+ * ordinary customer who crossed the amount. Reporting every customer as a PEP is not the cautious
+ * reading - an analyst who sees a PEP alert on a salaried individual learns to ignore PEP alerts,
+ * and the one real politically exposed person is then missed among them.
+ */
+public enum AmlSubjectScope {
+
+    /** Politically exposed person, their relative or close associate. */
+    PEP,
+
+    /** Trust, society or other not-for-profit - cash withdrawals from these carry their own rule. */
+    CHARITABLE_ORG,
+
+    /**
+     * Dealers in precious metal and stones and the other businesses RBI names as higher risk,
+     * where a large transaction is worth reporting that would be routine for anyone else.
+     */
+    HIGH_RISK_BUSINESS,
+
+    /**
+     * A recently opened account. A large transaction through an account that has barely been used
+     * is the classic mule pattern; the same transaction on a decade-old account is not remarkable.
+     */
+    NEW_ACCOUNT;
+
+    public static AmlSubjectScope fromRule(final String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return AmlSubjectScope.valueOf(value.trim().toUpperCase());
+        } catch (final IllegalArgumentException e) {
+            // An unrecognised scope must not silently widen the rule back to everyone, so the
+            // caller treats null-from-blank and this case differently.
+            return null;
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlTransactionContext.java

@@ -19,7 +19,9 @@
 package org.apache.fineract.portfolio.aml.data;
 
 import java.math.BigDecimal;
+import java.time.LocalDate;
 import java.time.LocalDateTime;
+import java.util.List;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
 import org.apache.fineract.portfolio.client.domain.Client;
 
@@ -45,9 +47,43 @@ public final class AmlTransactionContext {
      * rules are simply skipped for this context rather than guessed at.
      */
     private final BigDecimal windowAggregateAmount;
+    /**
+     * Which way the money moved. A rule written about withdrawals must not fire on a deposit, and
+     * "repayment of loan in cash" is not the same event as a disbursal.
+     */
+    private final AmlDirection direction;
+    /**
+     * How many qualifying transactions make up {@link #windowAggregateAmount}. Structuring is a
+     * pattern of MANY small transactions, so the count is what separates it from one large one:
+     * a single ₹12,00,000 deposit is a CTR, not structuring, however the window total reads.
+     */
+    private final int windowTransactionCount;
+    /**
+     * Every qualifying amount in the window, so a rule can count only what falls inside its own
+     * band. A single count cannot serve every rule: this client's window held four deposits — three
+     * small ones and one of ₹12,00,000 — which satisfied "three or more" for a structuring rule
+     * whose band none of the four sat in. Structuring is several transactions of a similar size,
+     * and only the amounts themselves can say whether that happened.
+     */
+    private final List<BigDecimal> windowAmounts;
+
+    /**
+     * When the account this transaction moved through was opened. The "large transaction on a new
+     * account" rule is about the account rather than the customer, and an old customer can open a
+     * new account. Null where the caller could not establish it, in which case the customer's own
+     * activation date stands in.
+     */
+    private final LocalDate subjectOpenedOn;
 
     public AmlTransactionContext(AmlTransactionType transactionType, Long transactionId, Client client, BigDecimal amount,
             String currencyCode, LocalDateTime occurredOn, boolean cash, BigDecimal windowAggregateAmount) {
+        this(transactionType, transactionId, client, amount, currencyCode, occurredOn, cash, windowAggregateAmount, AmlDirection.UNKNOWN,
+                0, List.of(), null);
+    }
+
+    public AmlTransactionContext(AmlTransactionType transactionType, Long transactionId, Client client, BigDecimal amount,
+            String currencyCode, LocalDateTime occurredOn, boolean cash, BigDecimal windowAggregateAmount, AmlDirection direction,
+            int windowTransactionCount, List<BigDecimal> windowAmounts, LocalDate subjectOpenedOn) {
         this.transactionType = transactionType;
         this.transactionId = transactionId;
         this.client = client;
@@ -56,6 +92,26 @@ public final class AmlTransactionContext {
         this.occurredOn = occurredOn;
         this.cash = cash;
         this.windowAggregateAmount = windowAggregateAmount;
+        this.direction = direction;
+        this.windowTransactionCount = windowTransactionCount;
+        this.windowAmounts = windowAmounts == null ? List.of() : List.copyOf(windowAmounts);
+        this.subjectOpenedOn = subjectOpenedOn;
+    }
+
+    public AmlDirection getDirection() {
+        return direction;
+    }
+
+    public int getWindowTransactionCount() {
+        return windowTransactionCount;
+    }
+
+    public List<BigDecimal> getWindowAmounts() {
+        return windowAmounts;
+    }
+
+    public LocalDate getSubjectOpenedOn() {
+        return subjectOpenedOn;
     }
 
     public AmlTransactionType getTransactionType() {

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/event/AmlDomainServiceImpl.java

@@ -30,6 +30,7 @@ import org.apache.fineract.infrastructure.event.business.domain.loan.transaction
 import org.apache.fineract.infrastructure.event.business.domain.savings.transaction.SavingsDepositBusinessEvent;
 import org.apache.fineract.infrastructure.event.business.domain.savings.transaction.SavingsWithdrawalBusinessEvent;
 import org.apache.fineract.infrastructure.event.business.service.BusinessEventNotifierService;
+import org.apache.fineract.portfolio.aml.data.AmlDirection;
 import org.apache.fineract.portfolio.aml.data.AmlTransactionContext;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
 import org.apache.fineract.portfolio.aml.repository.AmlLoanTransactionQueryRepository;
@@ -113,12 +114,22 @@ public class AmlDomainServiceImpl implements AmlDomainService {
         }
         final LocalDate since = LocalDate.now().minusDays(STRUCTURING_WINDOW_DAYS);
         final List<SavingsAccountTransaction> recent = savingsQueryRepository.findForClientSince(client.getId(), since);
-        final BigDecimal windowAggregate = recent.stream().filter(t -> depositDirection ? t.isDeposit() : t.isWithdrawal())
-                .map(SavingsAccountTransaction::getAmount).reduce(BigDecimal.ZERO, BigDecimal::add);
+        // Same side of the ledger as the transaction being observed: a deposit is not part of a
+        // withdrawal pattern, so the two are aggregated separately.
+        final List<SavingsAccountTransaction> sameDirection = recent.stream()
+                .filter(t -> depositDirection ? t.isDeposit() : t.isWithdrawal()).toList();
+        // Each amount is carried through, not just the total: a rule has to be able to count what
+        // falls inside its own band. Three small deposits plus one of ₹12,00,000 satisfies "three or
+        // more" and a ₹10,00,000 total on the raw figures, which is how one large deposit came to be
+        // reported as structuring.
+        final List<BigDecimal> windowAmounts = sameDirection.stream().map(SavingsAccountTransaction::getAmount).toList();
+        final BigDecimal windowAggregate = windowAmounts.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
 
         final AmlTransactionContext context = new AmlTransactionContext(AmlTransactionType.SAVINGS, transaction.getId(), client,
                 transaction.getAmount(), transaction.getSavingsAccount().getCurrency().getCode(),
-                transaction.getDateOf().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate);
+                transaction.getDateOf().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate,
+                depositDirection ? AmlDirection.CREDIT : AmlDirection.DEBIT, sameDirection.size(), windowAmounts,
+                transaction.getSavingsAccount().getActivationDate());
         try {
             ruleEvaluationService.evaluate(context);
         } catch (final RuntimeException e) {
@@ -134,12 +145,18 @@ public class AmlDomainServiceImpl implements AmlDomainService {
         }
         final LocalDate since = LocalDate.now().minusDays(STRUCTURING_WINDOW_DAYS);
         final List<LoanTransaction> recent = loanQueryRepository.findForClientSince(client.getId(), since);
-        final BigDecimal windowAggregate = recent.stream().filter(LoanTransaction::isRepaymentLikeType)
-                .map(t -> t.getAmount(transaction.getLoan().getCurrency()).getAmount()).reduce(BigDecimal.ZERO, BigDecimal::add);
+        final List<LoanTransaction> repayments = recent.stream().filter(LoanTransaction::isRepaymentLikeType).toList();
+        final List<BigDecimal> windowAmounts = repayments.stream()
+                .map(t -> t.getAmount(transaction.getLoan().getCurrency()).getAmount()).toList();
+        final BigDecimal windowAggregate = windowAmounts.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
 
+        // A repayment takes money from the customer; a disbursal gives it to them. Rules such as
+        // "repayment of loan in cash" are about the first and must not fire on the second.
+        final AmlDirection direction = transaction.isRepaymentLikeType() ? AmlDirection.DEBIT : AmlDirection.CREDIT;
         final AmlTransactionContext context = new AmlTransactionContext(AmlTransactionType.LOAN, transaction.getId(), client,
                 transaction.getAmount(transaction.getLoan().getCurrency()).getAmount(), transaction.getLoan().getCurrency().getCode(),
-                transaction.getTransactionDate().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate);
+                transaction.getTransactionDate().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate, direction,
+                repayments.size(), windowAmounts, transaction.getLoan().getApprovedOnDate());
         try {
             ruleEvaluationService.evaluate(context);
         } catch (final RuntimeException e) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlAlertReadPlatformServiceImpl.java

@@ -18,15 +18,25 @@
  */
 package org.apache.fineract.portfolio.aml.service;
 
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.portfolio.aml.data.AmlAlertData;
+import org.apache.fineract.portfolio.aml.data.AmlMatchedRuleData;
 import org.apache.fineract.portfolio.aml.domain.AmlAlert;
 import org.apache.fineract.portfolio.aml.domain.AmlAlertRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRule;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRuleRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlTransactionRule;
+import org.apache.fineract.portfolio.aml.domain.AmlTransactionRuleRepository;
 import org.apache.fineract.portfolio.client.domain.ClientRiskRuleRepository;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -38,22 +48,127 @@ public class AmlAlertReadPlatformServiceImpl implements AmlAlertReadPlatformServ
 
     private final AmlAlertRepository repository;
     private final ClientRiskRuleRepository clientRiskRuleRepository;
+    private final AmlAlertRuleRepository alertRuleRepository;
+    private final AmlTransactionRuleRepository transactionRuleRepository;
 
     @Override
     public List<AmlAlertData> retrieve(String statusFilter) {
         final List<AmlAlert> alerts = (statusFilter == null || statusFilter.isBlank()) ? repository.findAll()
                 : repository.findByStatusOrderByRaisedOnAsc(statusFilter);
+        // Nothing flagged is an ordinary state - a quiet period, or a bank that has just been set up - and every
+        // lookup below reads a list built from these alerts. An empty IN clause is a syntax error in Postgres, so
+        // without this the screen fails outright at the very moment it has nothing to report.
+        if (alerts.isEmpty()) {
+            return List.of();
+        }
         // Resolved once for the whole page rather than per alert: many alerts share a rule, so a
         // lookup inside the map step would re-read the same catalog rows repeatedly.
-        final Map<Long, Integer> riskByRiskRuleId = riskCategoriesFor(alerts);
+        // Same reasoning for the also-matched rules, which are held on the alert as bare codes: one
+        // read for every code on the page, not one per alert.
+        // The findings beneath each alert - one row per rule, carrying that rule's own disposition. Read for the whole
+        // page at once rather than per alert.
+        final Map<Long, List<AmlAlertRule>> findingsByAlertId = this.alertRuleRepository
+                .findByAlertIdIn(alerts.stream().map(AmlAlert::getId).toList()).stream()
+                .collect(Collectors.groupingBy(f -> f.getAlert().getId()));
+        final Map<String, AmlTransactionRule> rulesByCode = rulesByCodeFor(alerts, findingsByAlertId);
+        final Map<Long, Integer> riskByRiskRuleId = riskCategoriesFor(alerts, rulesByCode.values());
         return alerts.stream().sorted(Comparator.comparing(AmlAlert::getRaisedOn).reversed())
-                .map(alert -> mapToData(alert, riskByRiskRuleId)).collect(Collectors.toList());
+                .map(alert -> mapToData(alert, riskByRiskRuleId, rulesByCode, findingsByAlertId)).collect(Collectors.toList());
     }
 
-    /** Severity of each originating catalog rule, keyed on m_client_risk_rule.id. */
-    private Map<Long, Integer> riskCategoriesFor(final List<AmlAlert> alerts) {
-        final List<Long> sourceIds = alerts.stream().map(a -> a.getRule().getSourceClientRiskRuleId()).filter(id -> id != null).distinct()
-                .toList();
+    /**
+     * Every rule named anywhere on this page, keyed on its code.
+     *
+     * <p>
+     * Covers the findings as well as the also-matched lists, because a finding holds only a code and the pane needs the
+     * description behind it.
+     */
+    private Map<String, AmlTransactionRule> rulesByCodeFor(final List<AmlAlert> alerts,
+            final Map<Long, List<AmlAlertRule>> findingsByAlertId) {
+        final Set<String> codes = alerts.stream().map(AmlAlert::getAlsoMatchedRules).filter(s -> s != null && !s.isBlank())
+                .flatMap(s -> Arrays.stream(s.split(","))).map(String::trim).filter(s -> !s.isEmpty())
+                .collect(Collectors.toCollection(java.util.HashSet::new));
+        findingsByAlertId.values().stream().flatMap(List::stream).map(AmlAlertRule::getRuleCode).forEach(codes::add);
+        alerts.stream().map(a -> a.getRule().getRuleCode()).forEach(codes::add);
+        if (codes.isEmpty()) {
+            return Map.of();
+        }
+        final Map<String, AmlTransactionRule> byCode = new HashMap<>();
+        this.transactionRuleRepository.findByRuleCodeIn(codes).forEach(rule -> byCode.put(rule.getRuleCode(), rule));
+        return byCode;
+    }
+
+    /**
+     * Every rule the transaction matched, governing one first, each carrying its description and severity.
+     *
+     * <p>
+     * A rule whose catalog ancestor is missing still appears, with a null severity rather than being dropped: the
+     * officer needs to see that it fired. A code with no rule behind it at all - a rule deleted since the alert was
+     * raised - keeps its code as the description, because the alert is a record of what happened and editing the rule
+     * set afterwards does not change that.
+     */
+    private List<AmlMatchedRuleData> matchedRulesOf(final AmlAlert alert, final Map<Long, Integer> riskByRiskRuleId,
+            final Map<String, AmlTransactionRule> rulesByCode, final Map<Long, List<AmlAlertRule>> findingsByAlertId) {
+        final List<AmlAlertRule> findings = findingsByAlertId.get(alert.getId());
+        if (findings != null && !findings.isEmpty()) {
+            // Governing rule first, then by code, so the pane does not reorder itself between reads.
+            return findings.stream()
+                    .sorted(Comparator.comparing(AmlAlertRule::isGoverning).reversed().thenComparing(AmlAlertRule::getRuleCode))
+                    .map(f -> new AmlMatchedRuleData(f.getRuleCode(), describe(f.getRuleCode(), rulesByCode), f.getRiskCategory(),
+                            f.isGoverning(), f.getDisposition(),
+                            f.getReviewedBy() == null ? null : f.getReviewedBy().getUsername(), f.getReviewNotes(),
+                            f.isDirectlyDecided()))
+                    .collect(Collectors.toList());
+        }
+
+        // No findings rows: an alert raised before they existed and not covered by the backfill. Rebuilt from the flat
+        // fields so the pane still shows what fired, with no per-rule disposition to report.
+        final List<AmlMatchedRuleData> matched = new ArrayList<>();
+        final Long governingSourceId = alert.getRule().getSourceClientRiskRuleId();
+        matched.add(new AmlMatchedRuleData(alert.getRule().getRuleCode(), alert.getRule().getDescription(),
+                governingSourceId == null ? null : riskByRiskRuleId.get(governingSourceId), true, null, null, null, false));
+
+        final String also = alert.getAlsoMatchedRules();
+        if (also == null || also.isBlank()) {
+            return matched;
+        }
+        for (final String raw : also.split(",")) {
+            final String code = raw.trim();
+            if (code.isEmpty()) {
+                continue;
+            }
+            final AmlTransactionRule rule = rulesByCode.get(code);
+            final Long sourceId = rule == null ? null : rule.getSourceClientRiskRuleId();
+            matched.add(new AmlMatchedRuleData(code, describe(code, rulesByCode),
+                    sourceId == null ? null : riskByRiskRuleId.get(sourceId), false, null, null, null, false));
+        }
+        return matched;
+    }
+
+    /**
+     * A rule's description, or its code when the rule itself is gone.
+     *
+     * <p>
+     * An alert records what was detected at the time; a rule retired since then does not erase the finding, so the code
+     * stands in rather than the row disappearing.
+     */
+    private String describe(final String ruleCode, final Map<String, AmlTransactionRule> rulesByCode) {
+        final AmlTransactionRule rule = rulesByCode.get(ruleCode);
+        return rule == null || rule.getDescription() == null ? ruleCode : rule.getDescription();
+    }
+
+    /**
+     * Severity of each originating catalog rule, keyed on m_client_risk_rule.id.
+     *
+     * <p>
+     * Covers the also-matched rules as well as the governing ones. Resolving only the governing rules left every
+     * also-matched rule reporting a null severity, which is exactly the thing the expanded row exists to show.
+     */
+    private Map<Long, Integer> riskCategoriesFor(final List<AmlAlert> alerts, final Collection<AmlTransactionRule> alsoMatched) {
+        final List<Long> sourceIds = Stream
+                .concat(alerts.stream().map(a -> a.getRule().getSourceClientRiskRuleId()),
+                        alsoMatched.stream().map(AmlTransactionRule::getSourceClientRiskRuleId))
+                .filter(id -> id != null).distinct().toList();
         final Map<Long, Integer> byId = new HashMap<>();
         if (sourceIds.isEmpty()) {
             return byId;
@@ -62,13 +177,15 @@ public class AmlAlertReadPlatformServiceImpl implements AmlAlertReadPlatformServ
         return byId;
     }
 
-    private AmlAlertData mapToData(AmlAlert alert, Map<Long, Integer> riskByRiskRuleId) {
+    private AmlAlertData mapToData(AmlAlert alert, Map<Long, Integer> riskByRiskRuleId, Map<String, AmlTransactionRule> rulesByCode,
+            Map<Long, List<AmlAlertRule>> findingsByAlertId) {
         final Long sourceRiskRuleId = alert.getRule().getSourceClientRiskRuleId();
         final Integer riskCategory = sourceRiskRuleId == null ? null : riskByRiskRuleId.get(sourceRiskRuleId);
         return new AmlAlertData(alert.getId(), alert.getTransactionType().name(), alert.getTransactionId(), alert.getClient().getId(),
                 alert.getClient().getDisplayName(), alert.getRule().getRuleCode(), alert.getRule().getDescription(), alert.getAmount(),
                 alert.getCurrencyCode(), alert.getRaisedOn(), alert.getStatus().name(),
                 alert.getReviewedBy() == null ? null : alert.getReviewedBy().getUsername(), alert.getReviewedOn(),
-                alert.getReviewNotes(), alert.getDisposition() == null ? null : alert.getDisposition().name(), riskCategory);
+                alert.getReviewNotes(), alert.getDisposition() == null ? null : alert.getDisposition().name(), riskCategory,
+                alert.getAlsoMatchedRules(), alert.getHighestSeverity(), matchedRulesOf(alert, riskByRiskRuleId, rulesByCode, findingsByAlertId));
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlAlertWritePlatformService.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.aml.service;
 
+import java.util.List;
 import org.apache.fineract.portfolio.aml.domain.AmlAlert;
 import org.apache.fineract.portfolio.aml.domain.AmlStrCase;
 
@@ -27,4 +28,29 @@ public interface AmlAlertWritePlatformService {
     AmlAlert whitelist(Long alertId, String notes);
 
     AmlStrCase escalate(Long alertId, String notes);
+
+    /**
+     * Escalates several alerts into a single STR case.
+     *
+     * <p>
+     * For a case raised off a customer's repeated behaviour rather than one transaction. Escalating each alert
+     * separately would put one case per transaction in front of the Principal Officer, each holding a fragment of a
+     * pattern that only means anything taken together - and a customer reviewed again a month later would add several
+     * more. An STR to FIU-IND reports the activity, so the case has to hold all of it.
+     *
+     * @param alertIds
+     *            the alerts the pattern is made of; any already covered by a case keep that case
+     * @return the case covering them, or null when every alert was already covered
+     */
+    AmlStrCase escalateAsOneCase(List<Long> alertIds, String notes);
+
+    /**
+     * Decides individual rules within one alert, leaving the rest open.
+     *
+     * @param ruleCodes
+     *            the rules being decided now
+     * @param disposition
+     *            WHITELIST or ESCALATE, applied to each of them
+     */
+    AmlAlert reviewRules(Long alertId, List<String> ruleCodes, String disposition, String notes);
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlAlertWritePlatformServiceImpl.java

@@ -19,12 +19,21 @@
 package org.apache.fineract.portfolio.aml.service;
 
 import jakarta.persistence.EntityNotFoundException;
+import java.util.List;
+import java.util.Set;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.aml.domain.AmlAlert;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertDisposition;
 import org.apache.fineract.portfolio.aml.domain.AmlAlertRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRule;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRuleRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertStatus;
 import org.apache.fineract.portfolio.aml.domain.AmlStrCase;
+import org.apache.fineract.portfolio.aml.domain.AmlStrCaseAlert;
+import org.apache.fineract.portfolio.aml.domain.AmlStrCaseAlertRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlStrCaseRepository;
+import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -34,28 +43,200 @@ import org.springframework.transaction.annotation.Transactional;
 public class AmlAlertWritePlatformServiceImpl implements AmlAlertWritePlatformService {
 
     private final AmlAlertRepository alertRepository;
+    private final AmlAlertRuleRepository alertRuleRepository;
     private final AmlStrCaseRepository strCaseRepository;
+    private final AmlStrCaseAlertRepository strCaseAlertRepository;
     private final PlatformSecurityContext context;
     private final ClientRiskEscalationService clientRiskEscalationService;
 
     @Override
     public AmlAlert whitelist(Long alertId, String notes) {
-        final AmlAlert alert = loadAlert(alertId);
+        final AmlAlert alert = loadForDisposal(alertId);
         alert.whitelist(context.authenticatedUser(), notes);
+        decideAllFindings(alertId, AmlAlertDisposition.WHITELIST, notes, true);
         return alertRepository.save(alert);
     }
 
     @Override
     public AmlStrCase escalate(Long alertId, String notes) {
-        final AmlAlert alert = loadAlert(alertId);
+        // loadForDisposal has already refused an alert that was decided, so this can only be reached on an open one.
+        // An STR is about the transaction, and one transaction gets one case.
+        final AmlAlert alert = loadForDisposal(alertId);
         alert.escalate(context.authenticatedUser(), notes);
+        decideAllFindings(alertId, AmlAlertDisposition.ESCALATE, notes, true);
         alertRepository.save(alert);
+        return strCaseRepository.findByAlertId(alertId).orElseGet(() -> openStrCase(alert));
+    }
 
+    private AmlStrCase openStrCase(final AmlAlert alert) {
         final AmlStrCase strCase = strCaseRepository.save(AmlStrCase.openFor(alert));
+        // Recorded in the link table as well as on alert_id, so every case describes what it covers the same way -
+        // a single-transaction case covering one alert, a pattern case covering several.
+        strCaseAlertRepository.save(AmlStrCaseAlert.link(strCase, alert));
         clientRiskEscalationService.onStrCaseEscalated(strCase);
         return strCase;
     }
 
+    @Override
+    public AmlStrCase escalateAsOneCase(final List<Long> alertIds, final String notes) {
+        if (alertIds == null || alertIds.isEmpty()) {
+            return null;
+        }
+
+        final AppUser currentUser = context.authenticatedUser();
+        AmlStrCase strCase = null;
+
+        for (final Long alertId : alertIds) {
+            final AmlAlert alert = loadForDisposal(alertId);
+
+            // An alert already inside a case keeps it. Two cases holding one transaction would reach FIU-IND twice
+            // under two references, and the older case is the one an officer may already have worked on.
+            final AmlStrCaseAlert existing = strCaseAlertRepository.findByAlert_Id(alertId).orElse(null);
+            if (existing != null) {
+                if (strCase == null) {
+                    strCase = existing.getStrCase();
+                }
+                continue;
+            }
+
+            alert.escalate(currentUser, notes);
+            decideAllFindings(alertId, AmlAlertDisposition.ESCALATE, notes, true);
+            alertRepository.save(alert);
+
+            if (strCase == null) {
+                // Opened from the first alert that needed one, which is the oldest: the case is dated and referenced
+                // from where the pattern starts rather than from whichever alert happened to be escalated last.
+                strCase = strCaseRepository.save(AmlStrCase.openFor(alert));
+                clientRiskEscalationService.onStrCaseEscalated(strCase);
+            }
+            strCaseAlertRepository.save(AmlStrCaseAlert.link(strCase, alert));
+        }
+
+        return strCase;
+    }
+
+    /**
+     * Records a decision against individual rules within one alert.
+     *
+     * <p>
+     * A transaction can trip six rules where five are explained by the customer's declared business and the sixth is
+     * not. Deciding those separately is the point; the alert's own status is then derived from what is left - it stays
+     * open while any rule is undecided, because a case with an open finding is not a closed case.
+     *
+     * <p>
+     * Escalating any rule opens the STR case for the transaction, and only one: an STR is about the transaction, not
+     * about each rule that described it. Escalating a second rule on an alert already escalated adds the finding
+     * without opening a duplicate case.
+     */
+    @Override
+    public AmlAlert reviewRules(final Long alertId, final List<String> ruleCodes, final String disposition, final String notes) {
+        final AmlAlert alert = loadForDisposal(alertId);
+        final AmlAlertDisposition decision = AmlAlertDisposition.valueOf(disposition);
+        final List<AmlAlertRule> findings = alertRuleRepository.findByAlertId(alertId);
+
+        final Set<String> requested = Set.copyOf(ruleCodes);
+        // A finding already decided is left alone, for the same reason the alert itself is: the decision recorded
+        // against a rule is the bank's answer on it, and a second pass writing over it would leave the file showing
+        // only whatever was sent last. Asked to decide rules that are all already decided, this refuses rather than
+        // silently doing nothing.
+        final List<AmlAlertRule> targeted = findings.stream()
+                .filter(f -> requested.contains(f.getRuleCode()) && !f.isDecided()).toList();
+        if (targeted.isEmpty()) {
+            throw new IllegalArgumentException(
+                    "No open rules matching " + String.join(", ", ruleCodes) + " on alert " + alertId + " — already decided");
+        }
+        for (final AmlAlertRule finding : targeted) {
+            finding.decide(decision, context.authenticatedUser(), notes, true);
+            alertRuleRepository.save(finding);
+        }
+
+        // Re-read state across every finding, including the ones just written, to decide where the alert now stands.
+        final boolean anyEscalated = findings.stream().anyMatch(AmlAlertRule::isEscalated);
+        final boolean wasEscalated = AmlAlertStatus.ESCALATED.equals(alert.getStatus());
+
+        // Suspicion carries the transaction, whatever else is still open. Waiting for every rule to be decided meant
+        // an officer could mark a withdrawal suspicious and watch the row sit there as RAISED with no STR case, purely
+        // because a second, innocuous rule had not been clicked - the one outcome that must never be delayed. One
+        // suspicious finding makes the transaction suspicious; the remaining rules are then recorded against a case
+        // that is already open.
+        if (anyEscalated) {
+            alert.escalate(context.authenticatedUser(), notes);
+            // The findings left open were carried into the escalation, so nothing is left dangling behind a decided
+            // case - but recorded as carried, not as named. The officer condemned the rule they ticked; the rest were
+            // closed to keep the case consistent, and the record must not claim otherwise.
+            decideAllFindings(alertId, AmlAlertDisposition.ESCALATE, notes, false);
+            alertRepository.save(alert);
+            if (!wasEscalated) {
+                final AmlStrCase strCase = strCaseRepository.save(AmlStrCase.openFor(alert));
+                clientRiskEscalationService.onStrCaseEscalated(strCase);
+            }
+            return alert;
+        }
+
+        // Clearing is the opposite: it only holds once nothing is left to look at. A transaction is not cleared while
+        // one of its rules is still unexamined.
+        //
+        // Statutory rules are not part of that test. A CTR carries no severity because it is not a graded suspicion -
+        // it is a return owed on the amount, filed whether or not the customer is above suspicion - so it is never
+        // offered to the officer to decide. Counting it as unexamined would leave the alert permanently unclearable,
+        // waiting on a judgement that is not the officer's to make.
+        if (!findings.stream().filter(f -> f.getRiskCategory() != null).allMatch(AmlAlertRule::isDecided)) {
+            return alertRepository.save(alert);
+        }
+        alert.whitelist(context.authenticatedUser(), notes);
+        return alertRepository.save(alert);
+    }
+
+    /**
+     * Carries a whole-alert decision down to every finding still open beneath it.
+     *
+     * <p>
+     * Deciding the alert decides everything in it. Without this a case closed from the row would leave its findings
+     * blank, and the expanded pane would show a whitelisted alert whose rules all still read as undecided. Findings
+     * already decided individually keep the decision the officer made about them.
+     */
+    private void decideAllFindings(final Long alertId, final AmlAlertDisposition disposition, final String notes,
+            final boolean directlyDecided) {
+        for (final AmlAlertRule finding : alertRuleRepository.findByAlertId(alertId)) {
+            if (!finding.isDecided()) {
+                finding.decide(disposition, context.authenticatedUser(), notes, directlyDecided);
+                alertRuleRepository.save(finding);
+            }
+        }
+    }
+
+    /**
+     * Loads an alert the current officer is entitled to dispose of.
+     *
+     * <p>
+     * An alert another officer has open is theirs until they decide it or hand it back. Two officers reaching their
+     * own verdicts on one transaction is the failure this prevents - both writes succeed, and the case ends up
+     * recorded as whatever the second one happened to choose. Refusing here rather than in the screen is what makes
+     * it a rule: the screen hides the buttons, but the endpoint is what enforces it.
+     */
+    private AmlAlert loadForDisposal(final Long alertId) {
+        final AmlAlert alert = loadAlert(alertId);
+
+        // A disposition is final. Whitelisting or escalating an alert is the bank's recorded answer to a flagged
+        // transaction - an escalation has already opened an STR case and re-rated the customer - and letting a second
+        // officer write over it would leave the file saying whatever was submitted last, with the earlier decision and
+        // the reasoning behind it simply gone. Anything that genuinely has to be revisited is reopened deliberately,
+        // through the STR case, where the change is itself recorded.
+        final AmlAlertStatus status = alert.getStatus();
+        if (AmlAlertStatus.WHITELISTED.equals(status) || AmlAlertStatus.ESCALATED.equals(status)) {
+            throw new IllegalStateException("Alert " + alertId + " was already " + status.name().toLowerCase() + " by "
+                    + (alert.getReviewedBy() == null ? "another officer" : alert.getReviewedBy().getUsername())
+                    + " and cannot be decided again");
+        }
+
+        final AppUser current = context.authenticatedUser();
+        if (alert.isHeldByAnother(current)) {
+            throw new IllegalStateException("Alert " + alertId + " is being reviewed by "
+                    + alert.getReviewedBy().getUsername() + " and cannot be decided by another officer until they release it");
+        }
+        return alert;
+    }
+
     private AmlAlert loadAlert(Long alertId) {
         return alertRepository.findById(alertId)
                 .orElseThrow(() -> new EntityNotFoundException("AML alert " + alertId + " does not exist"));

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlCtrReportGenerationService.java

@@ -26,11 +26,13 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.portfolio.aml.domain.AmlCtrReport;
 import org.apache.fineract.portfolio.aml.domain.AmlCtrReportLine;
 import org.apache.fineract.portfolio.aml.domain.AmlCtrReportLineRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlCtrReportRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlCtrReportStatus;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
 import org.apache.fineract.portfolio.aml.repository.AmlLoanTransactionQueryRepository;
 import org.apache.fineract.portfolio.aml.repository.AmlSavingsTransactionQueryRepository;
@@ -66,8 +68,21 @@ public class AmlCtrReportGenerationService {
 
     public AmlCtrReport generateForMonth(YearMonth month) {
         final String reportMonth = month.toString();
-        if (ctrReportRepository.findByReportMonth(reportMonth).isPresent()) {
-            throw new IllegalStateException("CTR report for " + reportMonth + " has already been generated");
+        // A month can be rebuilt while its report is still a draft, and must not be once it has been submitted.
+        // Refusing outright was the safer-looking rule and the wrong one: the batch is a snapshot, so a cash
+        // transaction posted after it ran belonged to that month's filing and could never be added to it - the report
+        // was permanently short of a transaction the bank is obliged to report. Regenerating a draft replaces its
+        // lines with what the month now holds; a submitted report is left exactly as filed.
+        final Optional<AmlCtrReport> existing = ctrReportRepository.findByReportMonth(reportMonth);
+        if (existing.isPresent()) {
+            final AmlCtrReport report = existing.get();
+            if (AmlCtrReportStatus.SUBMITTED.equals(report.getStatus())) {
+                throw new IllegalStateException(
+                        "CTR report for " + reportMonth + " has been submitted to FIU-IND and cannot be regenerated");
+            }
+            ctrReportLineRepository.deleteAll(ctrReportLineRepository.findByCtrReport_Id(report.getId()));
+            ctrReportRepository.delete(report);
+            ctrReportRepository.flush();
         }
 
         final LocalDate start = month.atDay(1);

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlCtrReportReadPlatformService.java

@@ -20,8 +20,26 @@ package org.apache.fineract.portfolio.aml.service;
 
 import java.util.List;
 import org.apache.fineract.portfolio.aml.data.AmlCtrReportData;
+import org.apache.fineract.portfolio.aml.data.AmlCtrReportLineData;
 
 public interface AmlCtrReportReadPlatformService {
 
     List<AmlCtrReportData> retrieveAll();
+
+    /**
+     * The reportable lines, resolved to the account, customer and branch a filing names.
+     *
+     * @param reportId
+     *            one month's report, or null for every generated month
+     */
+    List<AmlCtrReportLineData> retrieveLines(Long reportId);
+
+    /**
+     * Reportable cash transactions that no generated report contains yet.
+     *
+     * <p>
+     * The monthly batch is a snapshot; anything posted after it runs belongs to that month's filing but sits in no
+     * report until the month is regenerated. These are those transactions, so a reportable one is never invisible.
+     */
+    List<AmlCtrReportLineData> retrievePendingLines();
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlCtrReportReadPlatformServiceImpl.java

@@ -18,13 +18,18 @@
  */
 package org.apache.fineract.portfolio.aml.service;
 
+import java.math.BigDecimal;
+import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.List;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.portfolio.aml.data.AmlCtrReportData;
+import org.apache.fineract.portfolio.aml.data.AmlCtrReportLineData;
 import org.apache.fineract.portfolio.aml.domain.AmlCtrReport;
 import org.apache.fineract.portfolio.aml.domain.AmlCtrReportRepository;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -33,7 +38,90 @@ import org.springframework.transaction.annotation.Transactional;
 @Transactional(readOnly = true)
 public class AmlCtrReportReadPlatformServiceImpl implements AmlCtrReportReadPlatformService {
 
+    /**
+     * Savings transaction type 1 is a deposit and 2 a withdrawal; a CTR names which way the cash
+     * moved, so the line says so rather than leaving the reader to infer it from the amount.
+     */
+    private static final String LINES_SQL = """
+            SELECT l.id, l.ctr_report_id, r.report_month, l.transaction_type, l.transaction_id,
+                   l.client_id, c.display_name AS client_name, l.amount, l.is_connected_group,
+                   sa.account_no AS account_no, o.name AS branch_name, t.transaction_date,
+                   CASE WHEN t.transaction_type_enum = 1 THEN 'Deposit'
+                        WHEN t.transaction_type_enum = 2 THEN 'Withdrawal' END AS direction,
+                   sa.activatedon_date AS account_opened_on,
+                   sa.closedon_date AS account_closed_on,
+                   CASE sa.status_enum WHEN 100 THEN 'SUBMITTED' WHEN 200 THEN 'APPROVED'
+                        WHEN 300 THEN 'ACTIVE' WHEN 400 THEN 'WITHDRAWN' WHEN 500 THEN 'REJECTED'
+                        WHEN 600 THEN 'CLOSED' WHEN 700 THEN 'PRE-MATURE CLOSED'
+                        WHEN 800 THEN 'MATURED' END AS account_status,
+                   k.ckyc_number AS ckyc_number,
+                   -- The customer's own reference for the filing: CKYC number if the record carries
+                   -- one, else the CIF the bank knows them by. Never blank, because a relation row
+                   -- that identifies nobody cannot be reconciled against the customer card.
+                   COALESCE(NULLIF(c.external_id, ''), c.account_no) AS client_external_id,
+                   COALESCE(c.legal_form_enum, 1) = 1 AS individual
+              FROM m_aml_ctr_report_line l
+              JOIN m_aml_ctr_report r ON r.id = l.ctr_report_id
+              JOIN m_client c ON c.id = l.client_id
+              LEFT JOIN m_office o ON o.id = c.office_id
+              LEFT JOIN m_client_kyc k ON k.client_id = c.id
+              LEFT JOIN m_savings_account_transaction t
+                     ON t.id = l.transaction_id AND l.transaction_type = 'SAVINGS'
+              LEFT JOIN m_savings_account sa ON sa.id = t.savings_account_id
+            """;
+
+    /**
+     * Cash transactions that a CTR must name but that no generated report contains yet.
+     *
+     * <p>
+     * The monthly batch takes a snapshot the moment it runs. A ₹15,00,000 cash deposit posted after that run belongs
+     * to the same month's filing and appears nowhere - not in the report, not on the FIU screen - until someone thinks
+     * to regenerate. A reportable transaction that is invisible is the one failure this report cannot have, so it is
+     * listed here as pending: shaped exactly like a generated line, with no report behind it.
+     *
+     * <p>
+     * Individually-reportable transactions only. A connected group is an arithmetic fact about a whole month and
+     * cannot be decided while the month is still running.
+     */
+    private static final String PENDING_LINES_SQL = """
+            SELECT NULL::bigint AS id, NULL::bigint AS ctr_report_id,
+                   to_char(t.transaction_date, 'YYYY-MM') AS report_month,
+                   'SAVINGS' AS transaction_type, t.id AS transaction_id,
+                   c.id AS client_id, c.display_name AS client_name, t.amount, false AS is_connected_group,
+                   sa.account_no AS account_no, o.name AS branch_name, t.transaction_date,
+                   CASE WHEN t.transaction_type_enum = 1 THEN 'Deposit'
+                        WHEN t.transaction_type_enum = 2 THEN 'Withdrawal' END AS direction,
+                   sa.activatedon_date AS account_opened_on,
+                   sa.closedon_date AS account_closed_on,
+                   CASE sa.status_enum WHEN 100 THEN 'SUBMITTED' WHEN 200 THEN 'APPROVED'
+                        WHEN 300 THEN 'ACTIVE' WHEN 400 THEN 'WITHDRAWN' WHEN 500 THEN 'REJECTED'
+                        WHEN 600 THEN 'CLOSED' WHEN 700 THEN 'PRE-MATURE CLOSED'
+                        WHEN 800 THEN 'MATURED' END AS account_status,
+                   k.ckyc_number AS ckyc_number,
+                   COALESCE(NULLIF(c.external_id, ''), c.account_no) AS client_external_id,
+                   COALESCE(c.legal_form_enum, 1) = 1 AS individual
+              FROM m_savings_account_transaction t
+              JOIN m_savings_account sa ON sa.id = t.savings_account_id
+              JOIN m_client c ON c.id = sa.client_id
+              LEFT JOIN m_office o ON o.id = c.office_id
+              LEFT JOIN m_client_kyc k ON k.client_id = c.id
+              JOIN m_payment_detail pd ON pd.id = t.payment_detail_id
+              JOIN m_payment_type pt ON pt.id = pd.payment_type_id
+             WHERE pt.is_cash_payment = true
+               AND t.is_reversed = false
+               AND t.transaction_type_enum IN (1, 2)
+               AND t.amount >= ?
+               AND NOT EXISTS (
+                     SELECT 1 FROM m_aml_ctr_report_line el
+                      WHERE el.transaction_type = 'SAVINGS' AND el.transaction_id = t.id)
+             ORDER BY t.transaction_date DESC, t.amount DESC, t.id
+            """;
+
+    /** The CTR line: ₹10,00,000 in a single cash transaction. Mirrors AmlCtrReportGenerationService. */
+    private static final BigDecimal CTR_THRESHOLD = new BigDecimal("1000000");
+
     private final AmlCtrReportRepository repository;
+    private final JdbcTemplate jdbcTemplate;
 
     @Override
     public List<AmlCtrReportData> retrieveAll() {
@@ -41,6 +129,46 @@ public class AmlCtrReportReadPlatformServiceImpl implements AmlCtrReportReadPlat
                 .map(this::mapToData).collect(Collectors.toList());
     }
 
+    @Override
+    public List<AmlCtrReportLineData> retrieveLines(final Long reportId) {
+        final StringBuilder sql = new StringBuilder(LINES_SQL);
+        final List<Object> args = new ArrayList<>();
+        if (reportId != null) {
+            sql.append(" WHERE l.ctr_report_id = ? ");
+            args.add(reportId);
+        }
+        // Largest first: the line most likely to be questioned is the one the reviewer reads first.
+        sql.append(" ORDER BY r.report_month DESC, l.amount DESC, l.id ");
+
+        return jdbcTemplate.query(sql.toString(), LINE_MAPPER, args.toArray());
+    }
+
+    /**
+     * Reportable cash transactions no generated report contains yet.
+     *
+     * <p>
+     * Shaped as lines so the FIU screen can show them beside the filed ones, but with a null id and report id: they
+     * are not in a filing, and nothing here pretends they are. The filing is still made by generating the month, which
+     * is what makes them disappear from this list.
+     */
+    @Override
+    public List<AmlCtrReportLineData> retrievePendingLines() {
+        return jdbcTemplate.query(PENDING_LINES_SQL, LINE_MAPPER, CTR_THRESHOLD);
+    }
+
+    /** Shared by both queries, which select the same columns so a pending line renders like a filed one. */
+    private static final RowMapper<AmlCtrReportLineData> LINE_MAPPER = (rs, rowNum) -> new AmlCtrReportLineData(
+            rs.getObject("id") == null ? null : rs.getLong("id"),
+            rs.getObject("ctr_report_id") == null ? null : rs.getLong("ctr_report_id"), rs.getString("report_month"),
+            rs.getString("transaction_type"), rs.getObject("transaction_id") == null ? null : rs.getLong("transaction_id"),
+            rs.getLong("client_id"), rs.getString("client_name"), rs.getString("account_no"), rs.getString("branch_name"),
+            rs.getDate("transaction_date") == null ? null : rs.getDate("transaction_date").toLocalDate(), rs.getString("direction"),
+            rs.getBigDecimal("amount"), rs.getBoolean("is_connected_group"),
+            rs.getDate("account_opened_on") == null ? null : rs.getDate("account_opened_on").toLocalDate(),
+            rs.getDate("account_closed_on") == null ? null : rs.getDate("account_closed_on").toLocalDate(),
+            rs.getString("account_status"), rs.getString("ckyc_number"), rs.getString("client_external_id"),
+            rs.getBoolean("individual"));
+
     private AmlCtrReportData mapToData(AmlCtrReport report) {
         return new AmlCtrReportData(report.getId(), report.getReportMonth(), report.getGeneratedOn(), report.getRecordCount(),
                 report.getFileReference(), report.getStatus().name(), report.getSubmittedOn());

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlFundTransferEvaluationService.java

@@ -30,6 +30,7 @@ import org.apache.fineract.portfolio.client.domain.ClientRepositoryWrapper;
 import org.apache.fineract.portfolio.fundtransfer.domain.FundTransfer;
 import org.apache.fineract.portfolio.fundtransfer.domain.FundTransferStatus;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
 
 /**
@@ -42,7 +43,9 @@ import org.springframework.transaction.annotation.Transactional;
 @Service
 @RequiredArgsConstructor
 @Slf4j
-@Transactional
+// REQUIRES_NEW for the same reason as AmlRuleEvaluationServiceImpl: a failed alert write must not
+// be able to mark the caller's transfer transaction rollback-only and undo a settled transfer.
+@Transactional(propagation = Propagation.REQUIRES_NEW)
 public class AmlFundTransferEvaluationService {
 
     private static final int STRUCTURING_WINDOW_DAYS = 30;

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlRecurringAlertReadPlatformServiceImpl.java

@@ -79,9 +79,11 @@ public class AmlRecurringAlertReadPlatformServiceImpl implements AmlRecurringAle
             final List<AmlAlertData> alerts = byClient.get(clientId);
             final AmlRecurringReview lastReview = this.reviewRepository.findByClient_IdOrderByReviewedOnDesc(clientId).stream().findFirst()
                     .orElse(null);
-            // Reviewed at a lower count means new alerts have landed since — the customer has to
-            // come back, otherwise one early review would silence them permanently.
-            final boolean needsReview = lastReview == null || alerts.size() > lastReview.getAlertCountAtReview();
+            // A standing review holds the customer out until its window runs out, or until their behaviour has moved
+            // on far enough that it no longer describes them - see AmlRecurringReview#stillStands. It used to lapse on
+            // the very next alert, which brought a customer whose ordinary business trips a rule weekly straight back
+            // the day after being reviewed, for the officer to re-read the explanation they had just written.
+            final boolean needsReview = lastReview == null || !lastReview.stillStands(alerts.size());
             if (onlyNeedingReview && !needsReview) {
                 continue;
             }
@@ -91,7 +93,9 @@ public class AmlRecurringAlertReadPlatformServiceImpl implements AmlRecurringAle
                     summary.riskCategory(), alerts.size(),
                     (int) alerts.stream().filter(a -> a.riskCategory() != null && a.riskCategory() == HIGH_RISK).count(),
                     (int) alerts.stream().map(AmlAlertData::ruleCode).distinct().count(),
-                    (int) alerts.stream().filter(a -> "RAISED".equals(a.status()) || "UNDER_REVIEW".equals(a.status())).count(),
+                    // Open means undecided, not a named status: a status this count does not list would otherwise be
+                    // dropped from the customer's open figure while the alert still sits in the feed awaiting review.
+                    (int) alerts.stream().filter(a -> !"WHITELISTED".equals(a.status()) && !"ESCALATED".equals(a.status())).count(),
                     (int) alerts.stream().filter(a -> "ESCALATED".equals(a.status())).count(),
                     alerts.stream().map(AmlAlertData::amount).filter(x -> x != null).reduce(BigDecimal.ZERO, BigDecimal::add),
                     alerts.stream().map(AmlAlertData::raisedOn).min(Comparator.naturalOrder()).orElse(null),

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlRecurringAlertWritePlatformServiceImpl.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.aml.service;
 
+import java.time.LocalDateTime;
 import java.util.ArrayList;
 import java.util.List;
 import lombok.RequiredArgsConstructor;
@@ -26,6 +27,8 @@ import org.apache.fineract.infrastructure.core.data.ApiParameterError;
 import org.apache.fineract.infrastructure.core.data.DataValidatorBuilder;
 import org.apache.fineract.infrastructure.core.exception.PlatformApiDataValidationException;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.domain.AmlAlert;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlRecurringReview;
 import org.apache.fineract.portfolio.aml.domain.AmlRecurringReviewOutcome;
 import org.apache.fineract.portfolio.aml.domain.AmlRecurringReviewRepository;
@@ -45,6 +48,8 @@ public class AmlRecurringAlertWritePlatformServiceImpl implements AmlRecurringAl
     private final AmlRecurringAlertReadPlatformService readPlatformService;
     private final ClientRepositoryWrapper clientRepository;
     private final PlatformSecurityContext context;
+    private final AmlAlertRepository alertRepository;
+    private final AmlAlertWritePlatformService alertWritePlatformService;
 
     @Override
     @Transactional
@@ -59,9 +64,58 @@ public class AmlRecurringAlertWritePlatformServiceImpl implements AmlRecurringAl
 
         final AmlRecurringReview review = AmlRecurringReview.record(client, alertCount, parsedOutcome, notes.trim(),
                 this.context.authenticatedUser());
+
+        // The outcome now does what its name says. It used to do nothing at all: all three choices wrote the same row
+        // and the alerts were left exactly as they were, so an officer who chose ESCALATED believed they had raised an
+        // STR while the alerts sat untouched and no case ever reached the Principal Officer.
+        final int actioned = applyOutcomeToOpenAlerts(clientId, parsedOutcome, notes.trim(), window);
+        review.recordAlertsActioned(actioned);
+
         return this.reviewRepository.saveAndFlush(review).getId();
     }
 
+    /**
+     * Carries the reviewer's conclusion through to the customer's open alerts.
+     *
+     * <pre>
+     *   CLEARED    every open alert is whitelisted - the behaviour was explained, so nothing is left outstanding
+     *   ESCALATED  every open alert is escalated, which opens an STR case for the Principal Officer
+     *   MONITOR    nothing is disposed of - the point of monitoring is that the alerts stay open
+     * </pre>
+     *
+     * Each alert is disposed of individually rather than in bulk, because whitelist() and escalate() already carry the
+     * audit trail, the per-rule findings and the STR-case handling that a review has to leave behind. Reproducing any
+     * of that here would be a second, quieter path to the same records.
+     */
+    private int applyOutcomeToOpenAlerts(final Long clientId, final AmlRecurringReviewOutcome outcome, final String notes,
+            final int windowDays) {
+
+        if (AmlRecurringReviewOutcome.MONITOR.equals(outcome)) {
+            return 0;
+        }
+
+        final LocalDateTime since = LocalDateTime.now().minusDays(windowDays);
+        final List<AmlAlert> openAlerts = this.alertRepository.findOpenAlertsForClientSince(clientId, since);
+
+        final String trail = "Recurring-behaviour review: " + notes;
+
+        if (AmlRecurringReviewOutcome.ESCALATED.equals(outcome)) {
+            // One case for the whole pattern, not one per transaction. What is being reported is the customer's
+            // repeated activity, and the Principal Officer investigating it needs the transactions that make it up
+            // together - a case per alert would hand them four fragments of one story, and five more the next time
+            // this customer was reviewed.
+            this.alertWritePlatformService.escalateAsOneCase(openAlerts.stream().map(AmlAlert::getId).toList(), trail);
+            return openAlerts.size();
+        }
+
+        int actioned = 0;
+        for (final AmlAlert alert : openAlerts) {
+            this.alertWritePlatformService.whitelist(alert.getId(), trail);
+            actioned++;
+        }
+        return actioned;
+    }
+
     private AmlRecurringReviewOutcome validate(final Long clientId, final String outcome, final String notes) {
         final List<ApiParameterError> errors = new ArrayList<>();
         final DataValidatorBuilder validator = new DataValidatorBuilder(errors).resource(RESOURCE);

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlRuleEvaluationServiceImpl.java

@@ -20,31 +20,82 @@ package org.apache.fineract.portfolio.aml.service;
 
 import java.math.BigDecimal;
 import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.portfolio.aml.data.AmlDirection;
 import org.apache.fineract.portfolio.aml.data.AmlTransactionContext;
 import org.apache.fineract.portfolio.aml.domain.AmlAlert;
 import org.apache.fineract.portfolio.aml.domain.AmlAlertRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRule;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRuleRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlAppliesTo;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionRule;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionRuleRepository;
 import org.apache.fineract.portfolio.client.domain.ClientKyc;
 import org.apache.fineract.portfolio.client.domain.ClientKycRepository;
+import org.apache.fineract.portfolio.client.domain.ClientRiskRule;
+import org.apache.fineract.portfolio.client.domain.ClientRiskRuleRepository;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Propagation;
 import org.springframework.transaction.annotation.Transactional;
 
+/**
+ * REQUIRES_NEW rather than the default REQUIRED: AML monitoring is a passive observer of a
+ * transaction that has already succeeded. Joining the caller's transaction would let a failed
+ * alert insert mark it rollback-only, destroying the customer's deposit/withdrawal/transfer at
+ * commit time - and the callers' catch blocks cannot rescue that, because the damage is done to
+ * the shared transaction rather than thrown to them. A private transaction keeps AML failure
+ * contained to AML.
+ */
 @Service
 @RequiredArgsConstructor
-@Transactional
+@Transactional(propagation = Propagation.REQUIRES_NEW)
 public class AmlRuleEvaluationServiceImpl implements AmlRuleEvaluationService {
 
     private static final int MEDIUM_RISK = 2;
     private static final int HIGH_RISK = 3;
 
+    /**
+     * Rules that carry a filing obligation in their own right, whatever else the transaction also
+     * matched.
+     *
+     * <p>
+     * A CTR is not a suspicion - it is a return the bank owes FIU-IND on any cash transaction at or
+     * above ten lakh, and it is filed whether or not the customer is above suspicion. Letting a
+     * behavioural rule outrank it would bury a statutory filing behind an internal observation.
+     */
+    private static final Set<String> STATUTORY_RULE_CODES = Set.of("CTR_THRESHOLD_10L", "LARGE_CASH_TXN_25L",
+            "STRUCTURED_CTR_10L_MONTHLY");
+
+    /**
+     * Which rule an alert is raised under when a transaction matches several.
+     *
+     * <p>
+     * Statutory reporting first, because those must be filed. Then the largest threshold, which is
+     * the system's own measure of how far out of the ordinary the transaction is - a rule written
+     * for ₹25,00,000 is describing something graver than one written for ₹50,000. Rule code last,
+     * so the same transaction always reports under the same rule rather than shifting with whatever
+     * order the database returned.
+     */
+    private static final Comparator<AmlTransactionRule> RULE_PRECEDENCE = Comparator
+            .comparing((AmlTransactionRule r) -> STATUTORY_RULE_CODES.contains(r.getRuleCode()) ? 0 : 1)
+            .thenComparing(r -> r.getThresholdAmount() == null ? BigDecimal.valueOf(-1) : r.getThresholdAmount(),
+                    Comparator.reverseOrder())
+            .thenComparing(AmlTransactionRule::getRuleCode);
+
     private final AmlTransactionRuleRepository ruleRepository;
     private final AmlAlertRepository alertRepository;
+    private final AmlAlertRuleRepository alertRuleRepository;
     private final ClientKycRepository clientKycRepository;
+    private final ClientRiskRuleRepository clientRiskRuleRepository;
     private final AmlRecurringAlertNotificationService recurringAlertNotificationService;
+    private final AmlSubjectScopeResolver subjectScopeResolver;
 
     @Override
     public List<AmlAlert> evaluate(AmlTransactionContext context) {
@@ -52,15 +103,55 @@ public class AmlRuleEvaluationServiceImpl implements AmlRuleEvaluationService {
         candidates.addAll(ruleRepository.findByActiveTrueAndAppliesTo(context.getTransactionType().name()));
         candidates.addAll(ruleRepository.findByActiveTrueAndAppliesTo(AmlAppliesTo.ALL.name()));
 
-        final List<AmlAlert> raised = new ArrayList<>();
+        final List<AmlTransactionRule> matched = new ArrayList<>();
         for (final AmlTransactionRule rule : candidates) {
             if (isHit(rule, context)) {
-                final AmlAlert alert = AmlAlert.raise(context.getTransactionType(), context.getTransactionId(), context.getClient(), rule,
-                        context.getAmount(), context.getCurrencyCode(), context.getOccurredOn());
-                raised.add(alertRepository.save(alert));
+                matched.add(rule);
             }
         }
 
+        final List<AmlAlert> raised = new ArrayList<>();
+        if (!matched.isEmpty()) {
+            // One transaction, one alert. Raising one per matched rule meant a single ₹12,00,000
+            // cash deposit arrived as two open alerts - the CTR and the new-account rule - and the
+            // officer had to dispose of each. Nothing stopped them whitelisting one while
+            // escalating the other, leaving the same deposit recorded as both cleared and
+            // suspicious. A monitoring system reports a transaction once, under the rule that most
+            // warrants attention.
+            matched.sort(RULE_PRECEDENCE);
+            final AmlTransactionRule governing = matched.get(0);
+
+            // When the alert was raised, not the transaction's value date. The context carries the date the
+            // transaction is booked to, which is a LocalDate widened to midnight - so every alert on the screen read
+            // "00:00", and two alerts minutes apart were indistinguishable. A monitoring feed is ordered by when it
+            // noticed something; the value date is still on the transaction the alert points at.
+            final AmlAlert alert = AmlAlert.raise(context.getTransactionType(), context.getTransactionId(), context.getClient(),
+                    governing, context.getAmount(), context.getCurrencyCode(), DateUtils.getLocalDateTimeOfTenant());
+            // The rules that did not govern are still recorded: an analyst needs to see that the
+            // deposit was both reportable and on a new account, even though it is one case.
+            if (matched.size() > 1) {
+                alert.recordAlsoMatchedRules(
+                        matched.stream().skip(1).map(AmlTransactionRule::getRuleCode).collect(Collectors.joining(", ")));
+            }
+            // The worst band across everything that matched, not only the rule the alert was raised
+            // under. A statutory CTR outranks a high-severity behavioural rule when the governing
+            // rule is picked, so without this the screen would see "CTR, no severity" and offer the
+            // transaction up for a batch decision alongside ordinary low-value alerts.
+            final Map<Long, Integer> bandBySourceId = severityBySourceRuleId(matched);
+            alert.recordHighestSeverity(highestSeverityOf(bandBySourceId));
+            final AmlAlert saved = alertRepository.save(alert);
+
+            // One finding per rule, so each can be disposed of on its own. Severity is copied in
+            // rather than read back through the rule later: the alert records what was detected at
+            // the time, and re-banding a rule afterwards must not rewrite that.
+            for (final AmlTransactionRule rule : matched) {
+                final Long sourceId = rule.getSourceClientRiskRuleId();
+                alertRuleRepository.save(AmlAlertRule.of(saved, rule.getRuleCode(),
+                        sourceId == null ? null : bandBySourceId.get(sourceId), rule == governing));
+            }
+            raised.add(saved);
+        }
+
         // Every transaction type funnels through here, so the recurring-behaviour check is done once
         // in one place rather than repeated in each of the savings / loan / transfer callers. Passing
         // the batch size lets the service tell a first-time offender from a repeat one without
@@ -71,7 +162,49 @@ public class AmlRuleEvaluationServiceImpl implements AmlRuleEvaluationService {
         return raised;
     }
 
+    /**
+     * The worst severity band among the rules that matched.
+     *
+     * <p>
+     * A transaction rule carries no severity of its own; it inherits the risk category of the
+     * catalog entry it was derived from. Rules with no catalog ancestor - the CTR rules - contribute
+     * nothing, because a statutory return is not a graded suspicion. Null when none of the matched
+     * rules carried a severity at all.
+     */
+    private Integer highestSeverityOf(final Map<Long, Integer> bandBySourceId) {
+        Integer worst = null;
+        for (final Integer band : bandBySourceId.values()) {
+            if (band != null && (worst == null || band > worst)) {
+                worst = band;
+            }
+        }
+        return worst;
+    }
+
+    /**
+     * Severity of each matched rule's catalog ancestor, keyed on {@code m_client_risk_rule.id}.
+     *
+     * <p>
+     * Read once and used twice - for the alert's own highest-severity figure and for the per-rule findings written
+     * beneath it - rather than querying the catalog twice for the same rows.
+     */
+    private Map<Long, Integer> severityBySourceRuleId(final List<AmlTransactionRule> matched) {
+        final List<Long> sourceIds = matched.stream().map(AmlTransactionRule::getSourceClientRiskRuleId).filter(id -> id != null)
+                .distinct().toList();
+        if (sourceIds.isEmpty()) {
+            return Map.of();
+        }
+        final Map<Long, Integer> bandById = new HashMap<>();
+        for (final ClientRiskRule catalogRule : clientRiskRuleRepository.findAllById(sourceIds)) {
+            bandById.put(catalogRule.getId(), catalogRule.getRiskCategory());
+        }
+        return bandById;
+    }
+
     private boolean isHit(AmlTransactionRule rule, AmlTransactionContext context) {
+        if (!appliesToThisTransaction(rule, context)) {
+            return false;
+        }
         final BigDecimal threshold = resolveThreshold(rule, context);
         if (threshold == null) {
             // Pattern-only VELOCITY rules (e.g. same-day movement) need bespoke detection logic
@@ -82,14 +215,125 @@ public class AmlRuleEvaluationServiceImpl implements AmlRuleEvaluationService {
             case THRESHOLD:
                 return context.getAmount().compareTo(threshold) >= 0;
             case STRUCTURING:
+                return isStructuringHit(rule, context, threshold);
             case VELOCITY:
-                return context.getWindowAggregateAmount() != null
-                        && context.getWindowAggregateAmount().compareTo(threshold) >= 0;
+                return isVelocityHit(rule, context, threshold);
             default:
                 return false;
         }
     }
 
+    /**
+     * Whether this rule is about this transaction at all, before any amount is compared.
+     *
+     * <p>
+     * Everything below was previously unchecked, so a rule matched on amount alone: one ₹12,00,000
+     * cash deposit raised ten alerts, of which one was the genuine CTR hit and nine — "frequent low
+     * cash WITHDRAWAL", "charitable organisation", "PEP account" and the rest — were about
+     * transactions this was not. An analyst who cannot tell which of ten alerts is real stops
+     * reading them, and that is how a real one gets missed.
+     */
+    private boolean appliesToThisTransaction(AmlTransactionRule rule, AmlTransactionContext context) {
+        // A cash-reporting rule is about physical cash. A transfer or a cheque is traceable by
+        // definition and is not what CTR exists to catch.
+        if (rule.isCashOnly() && !context.isCash()) {
+            return false;
+        }
+        // Direction, where the rule names one. UNKNOWN means the caller could not establish it, so
+        // the filter is not applied rather than guessed at.
+        final String ruleDirection = rule.getDirection();
+        if (ruleDirection != null && context.getDirection() != AmlDirection.UNKNOWN
+                && !ruleDirection.equalsIgnoreCase(context.getDirection().name())) {
+            return false;
+        }
+        // And who the rule is about, for rules named after an entity rather than an amount.
+        // PEP_ACCOUNT_MONITORING was raised against an ordinary salaried customer because nothing
+        // here asked whether that customer was politically exposed.
+        return subjectScopeResolver.matches(rule.getSubjectScope(), context);
+    }
+
+    /**
+     * Structuring: many transactions each deliberately kept below a reporting threshold, summing
+     * to something that would have been reportable had it been done at once.
+     *
+     * <p>
+     * Two things separate it from one large transaction, and neither was being checked. The count:
+     * a pattern needs several transactions, so a single deposit is never structuring however large.
+     * And the band: each transaction has to sit in the rule's own min/max window — a ₹12,00,000
+     * deposit is not an instance of "splitting deposits just below ₹50,000", which is exactly what
+     * that rule used to report it as.
+     */
+    private boolean isStructuringHit(AmlTransactionRule rule, AmlTransactionContext context, BigDecimal threshold) {
+        if (context.getWindowAggregateAmount() == null) {
+            return false;
+        }
+        if (!isWithinRuleBand(rule, context.getAmount())) {
+            return false;
+        }
+        // Counted and summed over the rule's own band, not over the window as a whole. A window
+        // holding three ordinary small deposits and one ₹12,00,000 satisfies "three or more" and a
+        // ₹10,00,000 total on the raw figures, and that is how one large deposit came to be
+        // reported as structuring: none of the four was in the band the rule describes.
+        final List<BigDecimal> inBand = context.getWindowAmounts().stream().filter(a -> isWithinRuleBand(rule, a)).toList();
+        if (!hasEnoughTransactions(rule, inBand.size())) {
+            return false;
+        }
+        return inBand.stream().reduce(BigDecimal.ZERO, BigDecimal::add).compareTo(threshold) >= 0;
+    }
+
+    /**
+     * Velocity: an unusual number of transactions in a short window, whatever each one is worth.
+     *
+     * <p>
+     * Like structuring it needs a count — one transaction is not a velocity — but unlike structuring
+     * the individual amounts are not confined to a band, since the concern is the frequency itself.
+     */
+    private boolean isVelocityHit(AmlTransactionRule rule, AmlTransactionContext context, BigDecimal threshold) {
+        if (context.getWindowAggregateAmount() == null) {
+            return false;
+        }
+        // Also confined to the band, for the same reason: "frequent LOW cash deposit" is about a run
+        // of small ones, and a single ₹12,00,000 is not an instance of it however often the account
+        // is used.
+        if (!isWithinRuleBand(rule, context.getAmount())) {
+            return false;
+        }
+        final List<BigDecimal> inBand = context.getWindowAmounts().stream().filter(a -> isWithinRuleBand(rule, a)).toList();
+        if (!hasEnoughTransactions(rule, inBand.size())) {
+            return false;
+        }
+        return inBand.stream().reduce(BigDecimal.ZERO, BigDecimal::add).compareTo(threshold) >= 0;
+    }
+
+    /**
+     * Whether this transaction sits inside the band the rule describes.
+     *
+     * <p>
+     * A rule with no band stated matches any amount, which is how these rules behaved before the
+     * columns existed and is what a rule that only names a window total still means.
+     */
+    private boolean isWithinRuleBand(AmlTransactionRule rule, BigDecimal amount) {
+        final BigDecimal min = rule.getMinLimitAmount();
+        final BigDecimal max = rule.getMaxLimitAmount();
+        if (min != null && amount.compareTo(min) < 0) {
+            return false;
+        }
+        return max == null || amount.compareTo(max) <= 0;
+    }
+
+    /**
+     * Whether enough transactions have happened in the window to call this a pattern.
+     *
+     * <p>
+     * A rule that states no minimum keeps the old behaviour; the seeded pattern rules all state 3,
+     * because two large deposits in a month is ordinary business and RBI's own wording is
+     * "numerous".
+     */
+    private boolean hasEnoughTransactions(AmlTransactionRule rule, int countInBand) {
+        final Integer minimum = rule.getMinTransactionCount();
+        return minimum == null || minimum <= 1 || countInBand >= minimum;
+    }
+
     /**
      * Rules with both tiered columns null use {@code thresholdAmount} for every client, unchanged
      * from prior behaviour. Tiered rules look up the transacting client's current KYC risk category

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlStrCaseWritePlatformServiceImpl.java

@@ -20,9 +20,15 @@ package org.apache.fineract.portfolio.aml.service;
 
 import jakarta.persistence.EntityNotFoundException;
 import java.time.LocalDate;
+import java.util.List;
+import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.domain.AmlAlert;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlStrCase;
+import org.apache.fineract.portfolio.aml.domain.AmlStrCaseAlert;
+import org.apache.fineract.portfolio.aml.domain.AmlStrCaseAlertRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlStrCaseRepository;
 import org.apache.fineract.portfolio.aml.domain.AmlStrConclusion;
 import org.apache.fineract.useradministration.domain.AppUser;
@@ -36,6 +42,8 @@ import org.springframework.transaction.annotation.Transactional;
 public class AmlStrCaseWritePlatformServiceImpl implements AmlStrCaseWritePlatformService {
 
     private final AmlStrCaseRepository strCaseRepository;
+    private final AmlStrCaseAlertRepository strCaseAlertRepository;
+    private final AmlAlertRepository alertRepository;
     private final AppUserRepository appUserRepository;
     private final PlatformSecurityContext context;
     private final StrSlaCalculator strSlaCalculator;
@@ -58,7 +66,36 @@ public class AmlStrCaseWritePlatformServiceImpl implements AmlStrCaseWritePlatfo
                 ? strSlaCalculator.calculateFiuDueDate(concludedOn, strCase.getClient().officeId())
                 : null;
         strCase.conclude(principalOfficer, conclusion, investigationNotes, sourceOfFundsNotes, concludedOn, fiuDueDate);
-        return strCaseRepository.save(strCase);
+        final AmlStrCase saved = strCaseRepository.save(strCase);
+
+        // The conclusion is the answer to the referral, so it goes back to the alerts that raised it. A case concluded
+        // clear leaves those transactions reading as suspicious on the AML feed until this runs - the bank would have
+        // decided one thing and the screen an officer works from would say another.
+        final boolean suspicious = conclusion == AmlStrConclusion.SUSPICIOUS;
+        final String note = "Principal Officer concluded " + (suspicious ? "suspicious" : "clear")
+                + (investigationNotes == null || investigationNotes.isBlank() ? "" : " — " + investigationNotes);
+        for (final AmlAlert alert : alertsOf(saved)) {
+            alert.applyStrConclusion(suspicious, principalOfficer, note);
+            alertRepository.save(alert);
+        }
+        return saved;
+    }
+
+    /**
+     * Every alert the case covers.
+     *
+     * <p>
+     * Read from the link table, which holds one row per alert: a pattern case is opened over several alerts, and
+     * concluding it has to answer all of them rather than only the one whose id happens to sit on the case.
+     */
+    private List<AmlAlert> alertsOf(final AmlStrCase strCase) {
+        final List<AmlAlert> covered = strCaseAlertRepository.findByStrCase_IdOrderByAlert_RaisedOnAsc(strCase.getId()).stream()
+                .map(AmlStrCaseAlert::getAlert).collect(Collectors.toList());
+        // Cases opened before the link table existed carry only alert_id.
+        if (covered.isEmpty() && strCase.getAlert() != null) {
+            covered.add(strCase.getAlert());
+        }
+        return covered;
     }
 
     @Override

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlSubjectScopeResolver.java

@@ -0,0 +1,136 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.service;
+
+import java.time.LocalDate;
+import java.util.Set;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.portfolio.aml.data.AmlSubjectScope;
+import org.apache.fineract.portfolio.aml.data.AmlTransactionContext;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.portfolio.client.domain.ClientKyc;
+import org.apache.fineract.portfolio.client.domain.ClientKycRepository;
+import org.springframework.stereotype.Service;
+
+/**
+ * Answers whether the customer behind a transaction is the kind of customer an entity-scoped rule is
+ * written about.
+ *
+ * <p>
+ * Everything here is read from what the customer record already holds - the client type chosen at
+ * onboarding, the KYC risk category, the account's own age. Nothing is inferred from the amount,
+ * because the amount is what the rule's threshold is already for.
+ */
+@Service
+@RequiredArgsConstructor
+public class AmlSubjectScopeResolver {
+
+    /**
+     * Client types that make an account a charitable/not-for-profit one for the purposes of the
+     * cash-withdrawal rule. Matched on the code value's text rather than its id, because ids are
+     * per-tenant and these are seeded per tenant.
+     */
+    private static final Set<String> CHARITABLE_CLIENT_TYPES = Set.of("TRUST", "SOCIETY", "NGO", "CHARITABLE TRUST");
+
+    /**
+     * Businesses RBI names as carrying higher money-laundering risk, where a large transaction is
+     * worth a second look that the same amount elsewhere would not be.
+     */
+    private static final Set<String> HIGH_RISK_CLIENT_TYPES = Set.of("JEWELLER", "BULLION DEALER", "REAL ESTATE AGENT",
+            "DEALER IN PRECIOUS METALS", "CASINO");
+
+    /** How long an account counts as new. RBI's own mule-account guidance works to a six-month window. */
+    private static final int NEW_ACCOUNT_DAYS = 180;
+
+    private static final int HIGH_RISK_KYC_CATEGORY = 3;
+
+    private final ClientKycRepository clientKycRepository;
+
+    /**
+     * Whether a rule carrying this scope should look at this transaction at all.
+     *
+     * <p>
+     * A rule with no scope is about the transaction rather than the customer and applies to
+     * everyone, which is how these rules behaved before the column existed.
+     */
+    public boolean matches(final String configuredScope, final AmlTransactionContext context) {
+        final AmlSubjectScope scope = AmlSubjectScope.fromRule(configuredScope);
+        if (scope == null) {
+            return true;
+        }
+        final Client client = context.getClient();
+        if (client == null) {
+            return false;
+        }
+        return switch (scope) {
+            case PEP -> isPoliticallyExposed(client);
+            case CHARITABLE_ORG -> isClientTypeIn(client, CHARITABLE_CLIENT_TYPES);
+            case HIGH_RISK_BUSINESS -> isClientTypeIn(client, HIGH_RISK_CLIENT_TYPES);
+            case NEW_ACCOUNT -> isNewAccount(context);
+        };
+    }
+
+    /**
+     * There is no dedicated PEP flag on the customer record, so the two places a CBS can carry that
+     * fact are used: an explicit "PEP" client classification, and a High KYC risk category, which is
+     * what a PEP is graded as under the KYC Master Direction. Absent both, the customer is not
+     * treated as a PEP - a rule that cannot identify its subject must raise nothing rather than
+     * report everyone.
+     */
+    private boolean isPoliticallyExposed(final Client client) {
+        if (codeValueMatches(client.clientClassification() == null ? null : client.clientClassification().getLabel(), "PEP")
+                || codeValueMatches(client.clientType() == null ? null : client.clientType().getLabel(), "PEP")) {
+            return true;
+        }
+        return clientKycRepository.findByClientId(client.getId()).map(ClientKyc::getRiskCategoryValue)
+                .filter(category -> category == HIGH_RISK_KYC_CATEGORY).isPresent();
+    }
+
+    private boolean isClientTypeIn(final Client client, final Set<String> wanted) {
+        final String type = client.clientType() == null ? null : client.clientType().getLabel();
+        final String classification = client.clientClassification() == null ? null : client.clientClassification().getLabel();
+        return containsIgnoreCase(wanted, type) || containsIgnoreCase(wanted, classification);
+    }
+
+    /**
+     * Measured from the customer's activation date against the business date, not the wall clock,
+     * so a back-dated test and a back-dated correction both read the age the books read.
+     */
+    private boolean isNewAccount(final AmlTransactionContext context) {
+        final LocalDate openedOn = context.getSubjectOpenedOn() != null ? context.getSubjectOpenedOn()
+                : context.getClient().getActivationDate();
+        if (openedOn == null) {
+            return false;
+        }
+        return openedOn.plusDays(NEW_ACCOUNT_DAYS).isAfter(DateUtils.getBusinessLocalDate());
+    }
+
+    private boolean containsIgnoreCase(final Set<String> wanted, final String value) {
+        if (value == null) {
+            return false;
+        }
+        final String normalised = value.trim().toUpperCase();
+        return wanted.contains(normalised);
+    }
+
+    private boolean codeValueMatches(final String value, final String token) {
+        return value != null && value.trim().toUpperCase().contains(token);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/ClientRiskChangeRequestService.java

@@ -0,0 +1,46 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.service;
+
+import java.util.List;
+import java.util.Map;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+
+/**
+ * Moving a customer's KYC risk category, under maker-checker.
+ *
+ * <p>
+ * The category decides how often the customer is re-KYC'd and what AML thresholds apply to them, so
+ * raising or lowering one is a decision about how closely the bank watches that customer. It is
+ * raised from the Risk Review Report - which already works out where a rating ought to sit - and
+ * takes effect only when a checker agrees.
+ */
+public interface ClientRiskChangeRequestService {
+
+    /** Raised by the reviewer. Nothing moves until a checker approves. */
+    CommandProcessingResult request(Long clientId, Integer requestedCategory, String reason);
+
+    /** Applies the new category to the customer's KYC record and records the change in history. */
+    CommandProcessingResult approve(Long requestId);
+
+    CommandProcessingResult reject(Long requestId, String rejectionReason);
+
+    /** @param status PENDING / APPROVED / REJECTED, or null for all */
+    List<Map<String, Object>> retrieveAll(String status);
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/ClientRiskChangeRequestServiceImpl.java

@@ -0,0 +1,241 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.service;
+
+import java.time.LocalDateTime;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.domain.ClientRiskCategoryHistory;
+import org.apache.fineract.portfolio.aml.domain.ClientRiskCategoryHistoryRepository;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.portfolio.client.domain.ClientKyc;
+import org.apache.fineract.portfolio.client.domain.ClientKycRepositoryWrapper;
+import org.apache.fineract.portfolio.client.domain.ClientRepositoryWrapper;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.support.GeneratedKeyHolder;
+import org.springframework.jdbc.support.KeyHolder;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+public class ClientRiskChangeRequestServiceImpl implements ClientRiskChangeRequestService {
+
+    private static final String STATUS_PENDING = "PENDING";
+    private static final String STATUS_APPROVED = "APPROVED";
+    private static final String STATUS_REJECTED = "REJECTED";
+
+    /** KycRiskCategory: 1 Low, 2 Medium, 3 High. */
+    private static final int LOWEST_CATEGORY = 1;
+    private static final int HIGHEST_CATEGORY = 3;
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final ClientRepositoryWrapper clientRepository;
+    private final ClientKycRepositoryWrapper kycRepositoryWrapper;
+    private final ClientRiskCategoryHistoryRepository historyRepository;
+
+    @Override
+    @Transactional
+    public CommandProcessingResult request(final Long clientId, final Integer requestedCategory, final String reason) {
+        final AppUser currentUser = this.context.authenticatedUser();
+
+        if (requestedCategory == null || requestedCategory < LOWEST_CATEGORY || requestedCategory > HIGHEST_CATEGORY) {
+            throw new IllegalArgumentException("Requested risk category must be Low (1), Medium (2) or High (3).");
+        }
+        if (reason == null || reason.isBlank()) {
+            throw new IllegalArgumentException("A reason is required to change a customer's risk category.");
+        }
+
+        final Client client = this.clientRepository.findOneWithNotFoundDetection(clientId);
+        final ClientKyc kyc = this.kycRepositoryWrapper.findByClientIdWithNotFoundDetection(clientId);
+        final Integer currentCategory = kyc.getRiskCategoryValue();
+
+        if (requestedCategory.equals(currentCategory)) {
+            throw new IllegalStateException("The customer is already on that risk category.");
+        }
+        if (!this.jdbcTemplate
+                .queryForList("SELECT id FROM m_client_risk_change_request WHERE client_id = ? AND status = 'PENDING'", clientId)
+                .isEmpty()) {
+            throw new IllegalStateException(
+                    "A risk category change is already pending for this customer. Wait for it to be approved or rejected.");
+        }
+
+        final KeyHolder kh = new GeneratedKeyHolder();
+        final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
+        this.jdbcTemplate.update(con -> {
+            final java.sql.PreparedStatement ps = con.prepareStatement(
+                    "INSERT INTO m_client_risk_change_request "
+                            + "(client_id, current_category, requested_category, reason, status, maker_id, created_date) "
+                            + "VALUES (?, ?, ?, ?, ?, ?, ?)",
+                    new String[] { "id" });
+            ps.setLong(1, client.getId());
+            if (currentCategory == null) {
+                ps.setNull(2, java.sql.Types.INTEGER);
+            } else {
+                ps.setInt(2, currentCategory);
+            }
+            ps.setInt(3, requestedCategory);
+            ps.setString(4, reason);
+            ps.setString(5, STATUS_PENDING);
+            ps.setLong(6, currentUser.getId());
+            ps.setObject(7, now);
+            return ps;
+        }, kh);
+
+        return new CommandProcessingResultBuilder().withClientId(client.getId())
+                .withEntityId(Objects.requireNonNull(kh.getKey()).longValue()).build();
+    }
+
+    @Override
+    @Transactional
+    public CommandProcessingResult approve(final Long requestId) {
+        final AppUser currentUser = this.context.authenticatedUser();
+        validateCheckerRole(currentUser);
+
+        final Map<String, Object> request = findRequestOrThrow(requestId);
+        if (!STATUS_PENDING.equals(request.get("status"))) {
+            throw new IllegalStateException("Risk change request is not pending. Current status: " + request.get("status"));
+        }
+        final Long makerId = ((Number) request.get("maker_id")).longValue();
+        if (makerId.equals(currentUser.getId()) && !currentUser.hasAnyPermission("ALL_FUNCTIONS")) {
+            throw new IllegalStateException("You cannot approve your own risk category change.");
+        }
+
+        final Long clientId = ((Number) request.get("client_id")).longValue();
+        final Integer requestedCategory = ((Number) request.get("requested_category")).intValue();
+
+        final Client client = this.clientRepository.findOneWithNotFoundDetection(clientId);
+        final ClientKyc kyc = this.kycRepositoryWrapper.findByClientIdWithNotFoundDetection(clientId);
+
+        // Read again rather than trusted from the request: the rating may have moved since - an AML
+        // auto-escalation on the customer's third STR case does exactly that - and the history has
+        // to record where it actually moved from.
+        final Integer previousCategory = kyc.getRiskCategoryValue();
+        if (requestedCategory.equals(previousCategory)) {
+            throw new IllegalStateException(
+                    "The customer is already on the requested risk category; the rating moved after this request was raised.");
+        }
+
+        // Moves the re-KYC due date onto the new category's cycle as well: a customer rated higher
+        // is called back in sooner, which is most of what the rating is for.
+        kyc.escalateRiskCategory(requestedCategory);
+        this.kycRepositoryWrapper.saveAndFlush(kyc);
+
+        final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
+        this.historyRepository.save(ClientRiskCategoryHistory.manual(client, previousCategory, requestedCategory,
+                (String) request.get("reason"), currentUser, now));
+
+        this.jdbcTemplate.update(
+                "UPDATE m_client_risk_change_request SET status = ?, checker_id = ?, checker_date = ? WHERE id = ?",
+                STATUS_APPROVED, currentUser.getId(), now, requestId);
+
+        return new CommandProcessingResultBuilder().withClientId(clientId).withEntityId(requestId).build();
+    }
+
+    @Override
+    @Transactional
+    public CommandProcessingResult reject(final Long requestId, final String rejectionReason) {
+        final AppUser currentUser = this.context.authenticatedUser();
+        validateCheckerRole(currentUser);
+
+        final Map<String, Object> request = findRequestOrThrow(requestId);
+        if (!STATUS_PENDING.equals(request.get("status"))) {
+            throw new IllegalStateException("Risk change request is not pending. Current status: " + request.get("status"));
+        }
+        final Long makerId = ((Number) request.get("maker_id")).longValue();
+        if (makerId.equals(currentUser.getId()) && !currentUser.hasAnyPermission("ALL_FUNCTIONS")) {
+            throw new IllegalStateException("You cannot reject your own risk category change.");
+        }
+
+        final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
+        this.jdbcTemplate.update(
+                "UPDATE m_client_risk_change_request SET status = ?, checker_id = ?, checker_date = ?, rejection_reason = ? "
+                        + "WHERE id = ?",
+                STATUS_REJECTED, currentUser.getId(), now, rejectionReason, requestId);
+
+        return new CommandProcessingResultBuilder().withEntityId(requestId).build();
+    }
+
+    @Override
+    public List<Map<String, Object>> retrieveAll(final String status) {
+        final StringBuilder sql = new StringBuilder("""
+                SELECT r.id                       AS "id",
+                       r.client_id                AS "clientId",
+                       c.display_name             AS "clientName",
+                       c.account_no               AS "cifNumber",
+                       o.name                     AS "officeName",
+                       r.current_category         AS "currentCategory",
+                       r.requested_category       AS "requestedCategory",
+                       r.reason                   AS "reason",
+                       r.status                   AS "status",
+                       maker.username             AS "makerUsername",
+                       to_char(r.created_date, 'YYYY-MM-DD HH24:MI') AS "createdDate",
+                       checker.username           AS "checkerUsername",
+                       to_char(r.checker_date, 'YYYY-MM-DD HH24:MI') AS "checkerDate",
+                       r.rejection_reason         AS "rejectionReason"
+                  FROM m_client_risk_change_request r
+                  JOIN m_client c ON c.id = r.client_id
+                  LEFT JOIN m_office o ON o.id = c.office_id
+                  JOIN m_appuser maker ON maker.id = r.maker_id
+                  LEFT JOIN m_appuser checker ON checker.id = r.checker_id
+                 WHERE 1 = 1
+                """);
+        final List<Object> args = new ArrayList<>();
+        if (status != null && !status.isBlank()) {
+            sql.append(" AND r.status = ? ");
+            args.add(status);
+        }
+        sql.append(" ORDER BY r.id DESC ");
+        return this.jdbcTemplate.queryForList(sql.toString(), args.toArray());
+    }
+
+    private Map<String, Object> findRequestOrThrow(final Long requestId) {
+        final List<Map<String, Object>> rows = this.jdbcTemplate
+                .queryForList("SELECT * FROM m_client_risk_change_request WHERE id = ?", requestId);
+        if (rows.isEmpty()) {
+            throw new IllegalArgumentException("Risk category change request not found.");
+        }
+        return rows.get(0);
+    }
+
+    /**
+     * The same checker rule the rest of the AML module uses: a rating change is a compliance
+     * decision, so it is approved by a manager rather than by whoever happens to be at the screen.
+     */
+    private void validateCheckerRole(final AppUser user) {
+        if (user.hasAnyPermission("ALL_FUNCTIONS")) {
+            return;
+        }
+        final boolean isChecker = user.getRoles().stream().map(r -> r.getName() == null ? "" : r.getName().toLowerCase().trim())
+                .anyMatch(n -> n.contains("manager") || n.contains("principal officer") || n.contains("compliance"));
+        if (!isChecker) {
+            throw new IllegalStateException(
+                    "Only a Bank Manager, Compliance Officer or Principal Officer can approve or reject a risk category change.");
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/ClientRiskEscalationServiceImpl.java

@@ -64,9 +64,13 @@ public class ClientRiskEscalationServiceImpl implements ClientRiskEscalationServ
             return;
         }
 
+        // Moves the re-KYC due date onto the new category's cycle as well, so the customer is
+        // called back in on the schedule the escalated rating requires.
         kyc.escalateRiskCategory(nextCategory);
         historyRepository.save(ClientRiskCategoryHistory.autoEscalation(client, previousCategory, nextCategory, strCase,
                 context.authenticatedUser(), LocalDateTime.now()));
+        log.info("Client {} auto-escalated from risk category {} to {} on the {}rd cumulative STR case; re-KYC now due {}",
+                client.getId(), previousCategory, nextCategory, cumulativeCases, kyc.getExpiryDate());
     }
 
     private Integer nextCategory(Integer currentCategory) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashexchange/api/CashExchangeApiResource.java

@@ -53,15 +53,28 @@ public class CashExchangeApiResource {
     @POST
     @Transactional
     public String create(String body) {
+        // Gated like every sibling register in this flow (CREATE_CASHTRANSFER,
+        // CREATE_CASHSETTLEMENT, CREATE_CASHINTERCASHIER). Cash exchange had no check at all, so any
+        // authenticated user -- not just a cashier -- could write legs that move a drawer's
+        // denomination position. Permission seeded and granted to the existing cash-handling roles by
+        // migration 0539.
+        this.context.authenticatedUser().validateHasPermissionTo("CREATE_CASHEXCHANGE");
+
         JsonObject json = JsonParser.parseString(body).getAsJsonObject();
 
         final Long accountId = json.has("accountId") && !json.get("accountId").isJsonNull() ? json.get("accountId").getAsLong() : null;
         final String accountNo = json.has("accountNo") && !json.get("accountNo").isJsonNull() ? json.get("accountNo").getAsString()
                 : null;
         final Long clientId = json.has("clientId") && !json.get("clientId").isJsonNull() ? json.get("clientId").getAsLong() : null;
+        // Defaulted, never left null: every as-of-date position query filters
+        // "ce.exchange_date <= CAST(? AS DATE)", which is false for NULL, so a null-dated exchange
+        // vanished from the cashier position and reconciliation reports while still counting in the
+        // undated stock query (DenominationBreakdownWriter.getCashierNetPosition). The drawer then
+        // read as holding the notes it had given away and none of the ones it had taken in. The
+        // sibling registers (cash transfer, settlement) already default the same way.
         final LocalDate exchangeDate = json.has("exchangeDate") && !json.get("exchangeDate").isJsonNull()
                 ? LocalDate.parse(json.get("exchangeDate").getAsString())
-                : null;
+                : DateUtils.getBusinessLocalDate();
         final String note = json.has("note") && !json.get("note").isJsonNull() ? json.get("note").getAsString() : null;
         final String customerIdProof = json.has("customerIdProof") && !json.get("customerIdProof").isJsonNull()
                 ? json.get("customerIdProof").getAsString() : null;
@@ -153,6 +166,10 @@ public class CashExchangeApiResource {
     @POST
     @Path("{id}/reverse")
     public String reverse(@PathParam("id") Long id, String body) {
+        // Reversing moves the same cash back, so it is gated the same way REVERSE_CASHTRANSFER and
+        // REVERSE_CASHSETTLEMENT already are. See create() above and migration 0539.
+        this.context.authenticatedUser().validateHasPermissionTo("REVERSE_CASHEXCHANGE");
+
         CashExchange exchange = repository.findById(id)
                 .orElseThrow(() -> new RuntimeException("Cash exchange not found: " + id));
         if (Boolean.TRUE.equals(exchange.getIsReversed())) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashierdeposit/api/CashierDepositRequestApiResource.java

@@ -54,7 +54,12 @@ import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformS
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.client.domain.KycExpiryStage;
+import org.apache.fineract.portfolio.client.service.KycRestrictionGuard;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
 import org.apache.fineract.portfolio.voucher.service.VoucherService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Component;
@@ -67,9 +72,28 @@ import com.google.common.base.Splitter;
 @Component
 @Tag(name = "Cashier Deposit Requests", description = "Maker-checker deposit request workflow: cashier submits, bank manager approves.")
 @RequiredArgsConstructor
+@lombok.extern.slf4j.Slf4j
 public class CashierDepositRequestApiResource {
 
+    // Named LOG rather than declared with @Slf4j: buildActivityLog uses a local "log" for the
+    // activity JsonArray, and a field of the same name reads as that variable at a glance.
+    private static final Logger LOG = LoggerFactory.getLogger(CashierDepositRequestApiResource.class);
+
+    // The temporary txn_id a pending deposit's denomination rows are tagged with (see
+    // savePendingDenomination) is this request's own id -- but m_savings_txn_denomination.txn_id has
+    // no reference-type discriminator, and a real m_savings_account_transaction id is drawn from the
+    // exact same small-integer range. Request #5 and transaction #5 coexisting is the ordinary case,
+    // not a rare one, so approve()'s "WHERE txn_id = <this request's id>" UPDATE (and reject()'s
+    // DELETE) would silently rewrite or erase an unrelated real transaction's own denomination
+    // breakdown whenever the two ids happened to match. Offsetting the temporary id into a range no
+    // real transaction id will reach in this system's lifetime makes every such match unambiguous,
+    // without a schema change. Kept well under CashReportApiResource's own implausible-millisecond-id
+    // band (10^12) so a request still sitting PENDING continues to count in cashier-position reports
+    // -- the cash is physically in the drawer already, approval or not.
+    private static final long PENDING_DEPOSIT_TXN_ID_OFFSET = 500_000_000L;
+
     private final JdbcTemplate jdbcTemplate;
+    private final KycRestrictionGuard kycRestrictionGuard;
     private final FromJsonHelper fromJsonHelper;
     private final PlatformSecurityContext context;
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
@@ -104,6 +128,12 @@ public class CashierDepositRequestApiResource {
         final String bankName = fromJsonHelper.extractStringNamed("bankName", root);
         final String txnDate = fromJsonHelper.extractStringNamed("txnDate", root);
         final String denominationData = fromJsonHelper.extractStringNamed("denominationData", root);
+        // What the counter says this GL credit is actually for — a code value under the
+        // "GLEntryType" code (Admin > System > Manage Codes), defaulting to "General" unless the row
+        // is one of the flows below picks up its own money later (Share Advance Collection, Sponsor
+        // DD), in which case that adoption checks this tag so it can never take a voucher meant for
+        // the other one. See 0565_convert_entry_type_to_code_value.xml.
+        final Long entryTypeCvId = resolveEntryTypeCvId(fromJsonHelper.extractLongNamed("entryTypeCvId", root));
         // DD + Cash + GL breakdown from Transaction Entry - null for ordinary deposit requests.
         // Persisted so the Sponsor DD issuance screen can read the breakdown back instead of
         // retyping face value/charges once this request is approved and selected as cash evidence.
@@ -124,6 +154,7 @@ public class CashierDepositRequestApiResource {
         if (amount == null || amount.compareTo(BigDecimal.ZERO) <= 0) {
             throw apiError(400, "Amount must be greater than zero");
         }
+        kycRestrictionGuard.check(savingsAccountId, KycRestrictionGuard.Operation.CREDIT);
         validateDenominationTotal(denominationData, amount);
         validateDdLimit(ddFaceValue);
 
@@ -135,8 +166,8 @@ public class CashierDepositRequestApiResource {
                  client_id, client_name, amount,
                  payment_type_id, payment_type_name, description, cheque_no, bank_name, txn_date,
                  status, cashier_id, cashier_name, cashier_username, denomination_data, activity_log, submitted_at,
-                 dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount)
-                VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+                 dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount, entry_type_cv_id)
+                VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
                 RETURNING id
                 """,
             Long.class,
@@ -148,7 +179,7 @@ public class CashierDepositRequestApiResource {
             "PENDING",
             currentUser.getId(), currentUser.getDisplayName(), currentUser.getUsername(),
             denominationData, activityLog, Timestamp.from(Instant.now()),
-            ddFaceValue, ddCharges, ddGstPercentage, ddGstAmount
+            ddFaceValue, ddCharges, ddGstPercentage, ddGstAmount, entryTypeCvId
         );
 
         // Globally unique voucher number from the central m_voucher register
@@ -161,7 +192,7 @@ public class CashierDepositRequestApiResource {
         // reject() will delete these records so the vault position is reversed.
         if (denominationData != null && !denominationData.isBlank()) {
             savePendingDenomination(denominationData, newId, savingsAccountId, accountNo, clientId,
-                currentUser.getId(), currentUser.getUsername());
+                currentUser.getId(), currentUser.getUsername(), paymentTypeName);
         }
 
         return gson.toJson(Map.of("resourceId", newId, "status", "PENDING", "voucherNo", voucherNo));
@@ -203,7 +234,7 @@ public class CashierDepositRequestApiResource {
             + " txn_date, status, cashier_id, cashier_name, cashier_username,"
             + " manager_id, manager_name, manager_username, rejection_reason, txn_id,"
             + " denomination_data, activity_log, submitted_at, actioned_at,"
-            + " dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount"
+            + " dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount, entry_type_cv_id"
             + " FROM m_cashier_deposit_request " + where
             + " ORDER BY submitted_at DESC LIMIT ? OFFSET ?",
             pageParams.toArray());
@@ -257,7 +288,7 @@ public class CashierDepositRequestApiResource {
                    payment_type_name, description, txn_date, status,
                    cashier_name, manager_name, manager_username, rejection_reason, txn_id,
                    submitted_at, actioned_at,
-                   dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount
+                   dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount, entry_type_cv_id
             FROM m_cashier_deposit_request
             """ + where + " ORDER BY submitted_at DESC LIMIT ? OFFSET ?",
             pageParams.toArray()
@@ -394,6 +425,20 @@ public class CashierDepositRequestApiResource {
             txnId = isCurrentAccount
                 ? executeCurrentAccountDeposit(savingsAccountId, amount, ptId, txnDateStr, description)
                 : executeSavingsDeposit(savingsAccountId, amount, ptId, txnDateStr, description);
+            if (!isCurrentAccount && txnId != null) {
+                // approve() is one @Transactional block, so an uncaught exception here would roll back
+                // the deposit that was just posted along with it -- every Cheque/DD approval that ever
+                // hit an edge case in the new hold-placement logic would fail entirely, where before
+                // this feature existed it always succeeded. Catching it keeps the Clearing Hold strictly
+                // best-effort: the deposit approval this whole endpoint exists for must never depend on
+                // it, only benefit from it when it works.
+                try {
+                    placeClearingHoldIfInstrumentDeposit(savingsAccountId, ptId, amount, txnDateStr);
+                } catch (final RuntimeException e) {
+                    log.warn("Could not place a Clearing Hold for cashier deposit request {} (savings account {}): {}", id,
+                        savingsAccountId, e.getMessage(), e);
+                }
+            }
         }
 
         // Link voucher to the created savings txn and stamp voucher_no on it.
@@ -406,6 +451,10 @@ public class CashierDepositRequestApiResource {
             }
         }
 
+        // The sides of the slip, recorded now rather than at submission: which accounts the money
+        // actually moved between is only settled once the request is approved and posted.
+        addDepositVoucherLines(record, savingsAccountId, amount);
+
         final String updatedLog = buildActivityLog(
             (String) record.get("activity_log"), "APPROVED", currentUser.getUsername(), null
         );
@@ -426,13 +475,15 @@ public class CashierDepositRequestApiResource {
         }
 
         // Denomination was already saved at submit time (cashier physically received cash then).
-        // Now update the temporary txn_id (request id) to the real Fineract transaction id.
-        // parseTxnIdToLong handles both decimal (savings/current) and hex (GL journal entry).
+        // Now update the temporary txn_id (offset request id -- see PENDING_DEPOSIT_TXN_ID_OFFSET) to
+        // the real Fineract transaction id. parseTxnIdToLong handles both decimal (savings/current)
+        // and hex (GL journal entry).
         if (txnId != null) {
             final Long realTxnId = parseTxnIdToLong(txnId);
             if (realTxnId != null) {
                 jdbcTemplate.update(
-                    "UPDATE m_savings_txn_denomination SET txn_id = ? WHERE txn_id = ?", realTxnId, id);
+                    "UPDATE m_savings_txn_denomination SET txn_id = ? WHERE txn_id = ?", realTxnId,
+                    id + PENDING_DEPOSIT_TXN_ID_OFFSET);
             }
         }
 
@@ -484,9 +535,10 @@ public class CashierDepositRequestApiResource {
             throw apiError(409, "This deposit request was already actioned by another manager.");
         }
 
-        // Reverse denomination — cashier physically returned cash to customer on rejection.
-        // The temporary denomination records (saved at submit time with txn_id = request id) are removed.
-        jdbcTemplate.update("DELETE FROM m_savings_txn_denomination WHERE txn_id = ?", id);
+        // Reverse denomination — cashier physically returned cash to customer on rejection. The
+        // temporary denomination records (saved at submit time with txn_id = offset request id -- see
+        // PENDING_DEPOSIT_TXN_ID_OFFSET) are removed.
+        jdbcTemplate.update("DELETE FROM m_savings_txn_denomination WHERE txn_id = ?", id + PENDING_DEPOSIT_TXN_ID_OFFSET);
 
         return gson.toJson(Map.of("resourceId", id, "status", "REJECTED"));
     }
@@ -540,6 +592,80 @@ public class CashierDepositRequestApiResource {
 
     // ── helpers ──────────────────────────────────────────────────────────────────
 
+    /**
+     * Records the two sides of an approved deposit on its voucher.
+     *
+     * A deposit is money arriving at the counter, so cash is debited and whatever receives it is
+     * credited — a member's savings account, or a GL account when the deposit was raised against
+     * one. The credited side is read from the request, because that is what the cashier actually
+     * filled in and what the member signed for.
+     *
+     * A failure here does not fail the approval. The deposit is already posted and the member's
+     * balance already raised; refusing that over its slip would take a correct transaction back for
+     * a paperwork reason. The problem is logged, and the voucher keeps its number without sides.
+     */
+    private void addDepositVoucherLines(final Map<?, ?> record, final Long savingsAccountId, final BigDecimal amount) {
+        final String voucherNo = (String) record.get("voucher_no");
+        if (voucherNo == null || voucherNo.isBlank()) {
+            return;
+        }
+
+        try {
+            final boolean isGl = "GL".equalsIgnoreCase((String) record.get("account_type"));
+            final String accountNo = (String) record.get("account_no");
+
+            // Cash reaching the counter. For a GL deposit the contra is the cash/vault account the
+            // request named; for a member deposit it is the cashier's own till, which the deposit
+            // register does not carry a GL id for — the line still names it, without an id.
+            final Object contraObj = record.get("contra_gl_id");
+            final Long contraGlId = contraObj != null ? ((Number) contraObj).longValue() : null;
+            final Map<String, Object> contra = glAccountForVoucher(contraGlId);
+            final VoucherLine debit = VoucherLine.debitGl(contraGlId, (String) contra.getOrDefault("name", "Cash in Hand"),
+                    (String) contra.get("gl_code"), amount);
+
+            final VoucherLine credit;
+            if (isGl) {
+                final Object glObj = record.get("gl_account_id");
+                final Long glAccountId = glObj != null ? ((Number) glObj).longValue() : null;
+                final Map<String, Object> gl = glAccountForVoucher(glAccountId);
+                credit = VoucherLine.creditGl(glAccountId, (String) gl.get("name"), (String) gl.get("gl_code"), amount);
+            } else {
+                // The request's own account_no is normally right, but if a cashier ever searched by a
+                // short/partial account number this is where that would surface -- prefer the number
+                // looked up fresh from savingsAccountId, the id actually posted against.
+                final String realAccountNo = savingsAccountNoOf((String) record.get("account_type"), savingsAccountId);
+                credit = VoucherLine.creditSavings(savingsAccountId, (String) record.get("client_name"),
+                        realAccountNo != null ? realAccountNo : accountNo, amount);
+            }
+
+            voucherService.addLines(voucherNo, List.of(debit, credit));
+        } catch (final RuntimeException e) {
+            LOG.error("Could not record voucher lines for deposit request voucher {}", voucherNo, e);
+        }
+    }
+
+    /** Name and code of a GL account, for printing on a voucher. Empty rather than absent if unmapped. */
+    /** "CURRENT" accounts live in their own {@code m_current_account} table with their own id space --
+     *  always querying {@code m_savings_account} would silently return an unrelated savings account's
+     *  number whenever the two id spaces happened to collide. Every other non-GL type here is a
+     *  {@code m_savings_account} row. */
+    private String savingsAccountNoOf(final String accountType, final Long accountId) {
+        if (accountId == null) {
+            return null;
+        }
+        final String table = "CURRENT".equalsIgnoreCase(accountType) ? "m_current_account" : "m_savings_account";
+        return jdbcTemplate.queryForList("SELECT account_no FROM " + table + " WHERE id = ?", String.class, accountId).stream()
+                .findFirst().orElse(null);
+    }
+
+    private Map<String, Object> glAccountForVoucher(final Long glAccountId) {
+        if (glAccountId == null) {
+            return Map.of();
+        }
+        return jdbcTemplate.queryForList("SELECT name, gl_code FROM acc_gl_account WHERE id = ?", glAccountId).stream().findFirst()
+                .orElse(Map.of());
+    }
+
     private Map<?, ?> loadRecord(final Long id) {
         final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
                 SELECT id, voucher_no, account_no, account_type, savings_account_id,
@@ -549,7 +675,7 @@ public class CashierDepositRequestApiResource {
                        txn_date, status, cashier_id, cashier_name, cashier_username,
                        manager_id, manager_name, manager_username, rejection_reason, txn_id,
                        denomination_data, activity_log, submitted_at, actioned_at,
-                       dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount
+                       dd_face_value, dd_charges, dd_gst_percentage, dd_gst_amount, entry_type_cv_id
                 FROM m_cashier_deposit_request WHERE id = ?
                 """, id);
         if (rows.isEmpty()) {
@@ -582,10 +708,64 @@ public class CashierDepositRequestApiResource {
             .withJson(payload.toString())
             .build();
 
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        // The deposit register raised its own voucher at submission and attaches the till and
+        // member sides to it on approval, so the savings command must not raise a second one over
+        // the same money -- exactly as the GL branch of this register already does below. Without
+        // this, one deposit appears twice on the cashier's received report and doubles the day's
+        // cash taken in.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(commandRequest));
         return result.getResourceId() != null ? result.getResourceId().toString() : null;
     }
 
+    /**
+     * A Cheque/DD deposit is credited to the ledger immediately (same as cash) but is not really the
+     * branch's own money yet -- it still has to clear. Real-world CBS practice is to hold that amount
+     * until the instrument clears rather than let it sit withdrawable, so this places an automatic
+     * Clearing Hold for the full deposited amount right after a Cheque/DD deposit posts. Cash and
+     * electronic-transfer payment types (NEFT/RTGS/IMPS/UPI) are untouched -- cash is available on the
+     * spot, and an electronic transfer has already settled by the time it's entered here.
+     */
+    private void placeClearingHoldIfInstrumentDeposit(final Long savingsAccountId, final Object paymentTypeId, final BigDecimal amount,
+            final String txnDateStr) {
+        if (paymentTypeId == null) {
+            return;
+        }
+        final Long ptId = ((Number) paymentTypeId).longValue();
+        // m_payment_type's display name column is "value", not "name" (the mistake that broke this
+        // in testing) -- name() collisions with other tables made this easy to get wrong once and not
+        // notice until it actually ran against the real schema.
+        final List<String> names = jdbcTemplate.query("SELECT value FROM m_payment_type WHERE id = ?",
+            (rs, rowNum) -> rs.getString("value"), ptId);
+        if (names.isEmpty()) {
+            return;
+        }
+        final String name = names.get(0).toLowerCase();
+        final boolean isInstrumentDeposit = name.contains("cheque") || name.contains("check") || name.equals("dd")
+            || name.contains("demand draft");
+        if (!isInstrumentDeposit) {
+            return;
+        }
+
+        final String today = LocalDate.now(DateUtils.getDateTimeZoneOfTenant()).format(DateTimeFormatter.ofPattern("dd MMMM yyyy"));
+        final String date = txnDateStr != null && !txnDateStr.isBlank() ? formatForFineract(txnDateStr) : today;
+
+        final JsonObject payload = new JsonObject();
+        payload.addProperty("locale", "en");
+        payload.addProperty("dateFormat", "dd MMMM yyyy");
+        payload.addProperty("transactionDate", date);
+        payload.addProperty("transactionAmount", amount);
+        payload.addProperty("reasonForBlock", "Pending clearing — " + names.get(0) + " deposit");
+        payload.addProperty("holdCategory", "CLEARING");
+        payload.addProperty("lienAllowed", false);
+
+        final CommandWrapper commandRequest = new CommandWrapperBuilder()
+            .holdAmount(savingsAccountId)
+            .withJson(payload.toString())
+            .build();
+        commandsSourceWritePlatformService.logCommandSource(commandRequest);
+    }
+
     private String executeCurrentAccountDeposit(
             final Long currentAccountId, final BigDecimal amount,
             final Object paymentTypeId, final String txnDateStr, final String note) {
@@ -610,7 +790,11 @@ public class CashierDepositRequestApiResource {
             .withJson(payload.toString())
             .build();
 
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        // Suppressed for the same reason as the savings path above. Current accounts raise no
+        // voucher of their own today, so this changes nothing now; it is here so that the day one
+        // is added, this register does not silently start double-counting again.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(commandRequest));
         return result.getResourceId() != null ? result.getResourceId().toString() : null;
     }
 
@@ -685,7 +869,10 @@ public class CashierDepositRequestApiResource {
             .withJson(payload.toString())
             .build();
 
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        // The deposit register raises its own voucher, naming the member and their account; the
+        // journal command must not raise a second one over the same money.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(commandRequest));
         return result.getTransactionId() != null ? result.getTransactionId() : null;
     }
 
@@ -699,7 +886,7 @@ public class CashierDepositRequestApiResource {
     // approve() updates txn_id to real Fineract id; reject() deletes these records.
     private void savePendingDenomination(final String denominationData,
             final Long requestId, final Long savingsAccountId, final String accountNo,
-            final Long clientId, final Long cashierId, final String cashierUsername) {
+            final Long clientId, final Long cashierId, final String cashierUsername, final String paymentTypeName) {
         final JsonObject denomMap;
         try {
             denomMap = gson.fromJson(denominationData, JsonObject.class);
@@ -729,12 +916,12 @@ public class CashierDepositRequestApiResource {
             jdbcTemplate.update("""
                 INSERT INTO m_savings_txn_denomination
                 (txn_id, savings_account_id, account_no, client_id, denomination_id,
-                 denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'DEPOSIT', ?, ?)
+                 denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username, payment_type)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'DEPOSIT', ?, ?, ?)
                 """,
-                requestId, savingsAccountId, accountNo, clientId, denomId,
+                requestId + PENDING_DEPOSIT_TXN_ID_OFFSET, savingsAccountId, accountNo, clientId, denomId,
                 value, count, BigDecimal.valueOf((long) value * count),
-                cashierId, cashierUsername
+                cashierId, cashierUsername, paymentTypeName
             );
         }
     }
@@ -851,6 +1038,18 @@ public class CashierDepositRequestApiResource {
         }
     }
 
+    /** The counter's choice, when they made one — otherwise "General" under the GLEntryType code,
+     *  resolved by name rather than a hardcoded id since Manage Codes owns these rows now. */
+    private Long resolveEntryTypeCvId(final Long provided) {
+        if (provided != null) {
+            return provided;
+        }
+        return jdbcTemplate.queryForObject(
+            "SELECT cv.id FROM m_code_value cv JOIN m_code c ON c.id = cv.code_id"
+                + " WHERE c.code_name = 'GLEntryType' AND cv.code_value = 'General'",
+            Long.class);
+    }
+
     private String buildActivityLog(final String existingJson, final String action,
             final String username, final String note) {
         JsonArray log = new JsonArray();

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashintercashier/api/CashInterCashierApiResource.java

@@ -23,12 +23,14 @@ import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.cashreport.api.CashReportApiResource;
 import org.apache.fineract.portfolio.cashreport.service.CashierRoleHelper;
 import org.apache.fineract.portfolio.cashintercashier.domain.CashInterCashier;
 import org.apache.fineract.portfolio.cashintercashier.domain.CashInterCashierDetail;
 import org.apache.fineract.portfolio.cashintercashier.domain.CashInterCashierDetailRepository;
 import org.apache.fineract.portfolio.cashintercashier.domain.CashInterCashierRepository;
 import org.apache.fineract.useradministration.domain.AppUser;
+import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Component;
 import org.springframework.transaction.annotation.Transactional;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
@@ -44,6 +46,10 @@ public class CashInterCashierApiResource {
     private final CashInterCashierDetailRepository detailRepository;
     private final PlatformSecurityContext context;
     private final CashierRoleHelper cashierRoleHelper;
+    private final JdbcTemplate jdbcTemplate;
+    // The same figure the Cashier Position screen shows, so a cashier cannot hand on notes the
+    // report says they are not holding -- CashSettlementApiResource depends on it the same way.
+    private final CashReportApiResource cashReportApiResource;
     private final Gson gson = new Gson();
 
     @POST
@@ -85,6 +91,21 @@ public class CashInterCashierApiResource {
             throw new PlatformDataIntegrityException("error.msg.cashintercashier.empty",
                     "At least one denomination with a positive count is required.");
         }
+
+        // The sending cashier has to actually hold these notes. Cash transfer validates the vault's
+        // stock and settlement validates the cashier's; this register validated neither, so a cashier
+        // holding five ₹500 notes could hand 200 of them to a colleague. Both sides are then wrong
+        // for ever, on every future date: the receiver's position, reconciliation and settlement
+        // allowance all rise by ₹1,00,000 of notes that do not exist, and the sender's reads
+        // -195x₹500 with nothing to net it back.
+        validateCashierHoldsDenominations(fromCashierId, denominations, transferDate);
+
+        // Both cashiers must sit under the same office. Nothing stopped a cross-branch inter-cashier
+        // transfer, which moves physical cash between two branches with no vault leg on either side
+        // -- so one branch's day-close is short and the other's is over, with no record of a transfer
+        // between them anywhere in either branch's register.
+        validateSameOffice(fromCashierId, toCashierId);
+
         final BigDecimal total = sumTotal(denominations);
 
         CashInterCashier header = new CashInterCashier();
@@ -206,6 +227,72 @@ public class CashInterCashierApiResource {
         return false;
     }
 
+    /**
+     * Same check, same source of truth and same message shape as
+     * {@code CashSettlementApiResource.validateCashierHoldsDenominations} -- the Cashier Position
+     * figure, so a cashier cannot hand over notes that report says they are not holding. An empty
+     * position is left alone rather than refused, matching the settlement path: a cashier with no
+     * recorded position yet is a setup state, not an overdraft.
+     */
+    private void validateCashierHoldsDenominations(final Long fromCashierId, final JsonArray denominations,
+            final LocalDate transferDate) {
+
+        final Map<String, Object> position = cashReportApiResource.buildPositionForCashier(fromCashierId,
+                transferDate.toString());
+
+        @SuppressWarnings("unchecked")
+        final List<Map<String, Object>> heldRows = (List<Map<String, Object>>) position.get("denominations");
+        if (heldRows == null || heldRows.isEmpty()) {
+            return;
+        }
+
+        final Map<Long, Long> held = new java.util.HashMap<>();
+        for (final Map<String, Object> row : heldRows) {
+            final Object id = row.get("denominationId");
+            final Object count = row.get("count");
+            if (id instanceof Number && count instanceof Number) {
+                held.merge(((Number) id).longValue(), ((Number) count).longValue(), Long::sum);
+            }
+        }
+
+        for (final JsonElement el : denominations) {
+            final JsonObject item = el.getAsJsonObject();
+            final long count = item.has("count") && !item.get("count").isJsonNull() ? item.get("count").getAsLong() : 0;
+            if (count <= 0 || !item.has("denominationId") || item.get("denominationId").isJsonNull()) {
+                continue;
+            }
+            final long denominationId = item.get("denominationId").getAsLong();
+            final int denominationValue = item.has("denominationValue") && !item.get("denominationValue").isJsonNull()
+                    ? item.get("denominationValue").getAsInt() : 0;
+            final long available = held.getOrDefault(denominationId, 0L);
+            if (count > available) {
+                throw new PlatformDataIntegrityException("error.msg.cashintercashier.insufficient.cashier.denomination",
+                        "Cashier is not holding that much of denomination " + denominationValue + ": has " + available
+                                + ", transferring " + count + ". Check the Cashier Position report first.");
+            }
+        }
+    }
+
+    /** Both cashiers must belong to the same office, via their own teller. */
+    private void validateSameOffice(final Long fromCashierId, final Long toCashierId) {
+        final List<Map<String, Object>> offices = jdbcTemplate.queryForList("""
+                SELECT c.id AS cashier_id, t.office_id FROM m_cashiers c JOIN m_tellers t ON t.id = c.teller_id
+                 WHERE c.id IN (?, ?)
+                """, fromCashierId, toCashierId);
+        if (offices.size() < 2) {
+            // One of them has no teller/office resolvable -- leave it to the existing party checks
+            // rather than inventing a new failure here.
+            return;
+        }
+        final Object first = offices.get(0).get("office_id");
+        final Object second = offices.get(1).get("office_id");
+        if (first != null && second != null && !first.equals(second)) {
+            throw new PlatformDataIntegrityException("error.msg.cashintercashier.cross.office",
+                    "Both cashiers must be in the same branch. Cash moving between branches has to go through"
+                            + " each branch's own vault, not a direct cashier-to-cashier transfer.");
+        }
+    }
+
     private void saveDetails(Long interCashierId, JsonArray items) {
         for (JsonElement el : items) {
             JsonObject item = el.getAsJsonObject();

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashreconciliation/api/CashReconciliationApiResource.java

@@ -28,6 +28,7 @@ import org.apache.fineract.portfolio.cashreconciliation.domain.CashReconciliatio
 import org.apache.fineract.portfolio.cashreconciliation.domain.CashReconciliationDetail;
 import org.apache.fineract.portfolio.cashreconciliation.domain.CashReconciliationDetailRepository;
 import org.apache.fineract.portfolio.cashreconciliation.domain.CashReconciliationRepository;
+import org.apache.fineract.portfolio.denominationmaster.service.CountedCashLedger;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Component;
@@ -89,6 +90,7 @@ public class CashReconciliationApiResource {
                 + "LEFT JOIN m_denomination_master dm ON dm.id = std.denomination_id "
                 + "WHERE std.txn_type = 'DEPOSIT' "
                 + "AND std.txn_date <= CAST(? AS DATE) "
+                + "AND " + CountedCashLedger.REAL_TXN_ID
                 + "AND std.officer_id IN ("
                 + "  SELECT au.id FROM m_appuser au "
                 + "  JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?) "
@@ -118,6 +120,7 @@ public class CashReconciliationApiResource {
                 + "LEFT JOIN m_denomination_master dm ON dm.id = std.denomination_id "
                 + "WHERE std.txn_type = 'WITHDRAWAL' "
                 + "AND std.txn_date <= CAST(? AS DATE) "
+                + "AND " + CountedCashLedger.REAL_TXN_ID
                 + "AND std.officer_id IN ("
                 + "  SELECT au.id FROM m_appuser au "
                 + "  JOIN m_cashiers mc ON mc.staff_id = au.staff_id WHERE mc.id = ?) "
@@ -259,6 +262,14 @@ public class CashReconciliationApiResource {
         final JsonArray denominations = json.has("denominations") && json.get("denominations").isJsonArray()
                 ? json.getAsJsonArray("denominations") : new JsonArray();
 
+        // Expected counts come from the server's own computation, never from the request body.
+        // Reading the client's expectedCount made the whole reconciliation self-certifying: a cashier
+        // Rs 40,000 short could post expectedCount == physicalCount on every row, and the record
+        // stored variance 0 / status OK. That row then satisfied the mandatory reconciliation
+        // precondition on settlement, so the shortage never surfaced anywhere in the system. The
+        // physical count is the cashier's to declare; what the books expect is not.
+        final Map<Long, Long> serverExpected = expectedCountsByDenomination(cashierId, reconDate);
+
         BigDecimal expectedTotal = BigDecimal.ZERO;
         BigDecimal physicalTotal = BigDecimal.ZERO;
         List<CashReconciliationDetail> details = new ArrayList<>();
@@ -266,7 +277,10 @@ public class CashReconciliationApiResource {
         for (JsonElement el : denominations) {
             JsonObject item = el.getAsJsonObject();
             int denomValue = item.has("denominationValue") ? item.get("denominationValue").getAsInt() : 0;
-            int expectedCount = item.has("expectedCount") ? item.get("expectedCount").getAsInt() : 0;
+            final Long denomIdForExpected = item.has("denominationId") && !item.get("denominationId").isJsonNull()
+                    ? item.get("denominationId").getAsLong() : null;
+            int expectedCount = denomIdForExpected != null
+                    ? serverExpected.getOrDefault(denomIdForExpected, 0L).intValue() : 0;
             int physicalCount = item.has("physicalCount") ? item.get("physicalCount").getAsInt() : 0;
             int varianceCount = physicalCount - expectedCount;
             BigDecimal varianceAmount = BigDecimal.valueOf((long) denomValue * varianceCount);
@@ -348,6 +362,30 @@ public class CashReconciliationApiResource {
                 rs.getLong("total_count")
             };
 
+    /**
+     * The server's own expected note/coin counts for a cashier as of a date, keyed by denomination
+     * id. Delegates to {@link #getExpected} rather than re-deriving the eight legs: two
+     * implementations of "what should this drawer hold" drift apart, and the one place that matters
+     * is the record a settlement is later allowed on the strength of.
+     */
+    private Map<Long, Long> expectedCountsByDenomination(final Long cashierId, final LocalDate asOfDate) {
+        final Map<Long, Long> expected = new java.util.HashMap<>();
+        final JsonObject computed = JsonParser.parseString(getExpected(cashierId, asOfDate.toString())).getAsJsonObject();
+        if (!computed.has("denominations") || !computed.get("denominations").isJsonArray()) {
+            return expected;
+        }
+        for (final JsonElement el : computed.getAsJsonArray("denominations")) {
+            final JsonObject row = el.getAsJsonObject();
+            if (!row.has("denominationId") || row.get("denominationId").isJsonNull()) {
+                continue;
+            }
+            final long count = row.has("expectedCount") && !row.get("expectedCount").isJsonNull()
+                    ? row.get("expectedCount").getAsLong() : 0L;
+            expected.merge(row.get("denominationId").getAsLong(), count, Long::sum);
+        }
+        return expected;
+    }
+
     private void addToBalance(Map<Long, long[]> balance, List<Object[]> rows, int sign) {
         for (Object[] row : rows) {
             Long denomId = (Long) row[0];

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashreport/service/VaultPositionService.java

@@ -0,0 +1,181 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.cashreport.service;
+
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.stereotype.Component;
+
+/**
+ * Denomination-wise cash a vault (teller) is currently holding.
+ *
+ * Anchored on the most recent business day (on or before the target date) whose branch day
+ * register recorded a vault-only opening breakdown ({@code OPENING_VAULT}, tagged with this exact
+ * teller), then walked forward by everything settled into this vault and handed out of it since.
+ * Vault-only rows exist separately from the branch-total {@code OPENING}/{@code CLOSING} rows
+ * (which mix the vault with whatever every cashier under it is holding) precisely so this anchor
+ * never includes cash that still physically sits with a cashier — mixing the two double-counts
+ * whatever a cashier settles back later, once already folded into the branch total, again as the
+ * settlement itself. A day recorded before vault-only tracking existed has no {@code OPENING_VAULT}
+ * row at all; the branch-total {@code OPENING} is used for it as a last resort so an old anchor
+ * still returns something rather than zero.
+ */
+@Component
+@RequiredArgsConstructor
+public class VaultPositionService {
+
+    private final JdbcTemplate jdbcTemplate;
+
+    // Row mapper: returns Object[]{Long denomId, Integer denomValue, String kind, Long count}
+    private static final RowMapper<Object[]> DENOM_ROW = (rs, r) -> new Object[] { rs.getLong("denomination_id"),
+            rs.getInt("denomination_value"), rs.getString("kind"), rs.getLong("total_count") };
+
+    public Map<String, Object> buildPositionForVault(final Long tellerId, final String dateFilter) {
+        final Map<String, Object> result = new LinkedHashMap<>();
+        result.put("tellerId", tellerId);
+        result.put("asOfDate", dateFilter);
+
+        String tellerName = null;
+        Long officeId = null;
+        try {
+            final Map<String, Object> teller = jdbcTemplate.queryForMap("SELECT name, office_id FROM m_tellers WHERE id = ?",
+                    tellerId);
+            tellerName = (String) teller.get("name");
+            officeId = ((Number) teller.get("office_id")).longValue();
+        } catch (final Exception ignored) {
+            // intentionally ignored
+        }
+        result.put("tellerName", tellerName);
+
+        if (officeId == null) {
+            result.put("hasBreakdown", false);
+            result.put("totalAmount", BigDecimal.ZERO);
+            result.put("denominations", new ArrayList<>());
+            return result;
+        }
+
+        // Prefer a vault-scoped anchor: it already reflects only this vault's own cash, carried
+        // forward day to day, with no cashier's held cash folded in. Fall back to the old
+        // branch-combined OPENING leg only when this office has no vault-scoped row at all on or
+        // before the target date (a day closed before vault-only tracking existed).
+        List<Map<String, Object>> anchorRows = jdbcTemplate.queryForList("""
+                SELECT r.id AS register_id, r.business_date FROM m_branch_day_register r
+                 WHERE r.office_id = ? AND r.business_date <= CAST(? AS DATE)
+                   AND EXISTS (SELECT 1 FROM m_branch_day_register_detail d
+                                WHERE d.register_id = r.id AND d.leg = 'OPENING_VAULT' AND d.teller_id = ?)
+                 ORDER BY r.business_date DESC LIMIT 1
+                """, officeId, dateFilter, tellerId);
+        String anchorLeg = "OPENING_VAULT";
+        if (anchorRows.isEmpty()) {
+            // The branch-total OPENING leg mixes the vault with whatever every cashier under it
+            // holds, so it is only a defensible stand-in for a vault when the office has exactly one
+            // teller. With two, EVERY teller without a vault-scoped row of its own would anchor on
+            // the same office-wide breakdown, and the frontend's Branch Total -- which sums each
+            // teller's vault -- would report roughly twice the branch's actual cash. Worse, a close
+            // then snapshots that inflated figure as this teller's CLOSING_VAULT and the next open
+            // carries it forward, making the phantom permanent. A second teller with no history of
+            // its own genuinely holds nothing, and returning no breakdown says so honestly.
+            final Integer tellerCount = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_tellers WHERE office_id = ?",
+                    Integer.class, officeId);
+            if (tellerCount != null && tellerCount == 1) {
+                anchorLeg = "OPENING";
+                anchorRows = jdbcTemplate.queryForList("""
+                        SELECT r.id AS register_id, r.business_date FROM m_branch_day_register r
+                         WHERE r.office_id = ? AND r.business_date <= CAST(? AS DATE)
+                           AND EXISTS (SELECT 1 FROM m_branch_day_register_detail d
+                                        WHERE d.register_id = r.id AND d.leg = 'OPENING')
+                         ORDER BY r.business_date DESC LIMIT 1
+                        """, officeId, dateFilter);
+            }
+        }
+
+        if (anchorRows.isEmpty()) {
+            result.put("hasBreakdown", false);
+            result.put("totalAmount", BigDecimal.ZERO);
+            result.put("denominations", new ArrayList<>());
+            return result;
+        }
+
+        final Long registerId = ((Number) anchorRows.get(0).get("register_id")).longValue();
+        final String anchorDate = anchorRows.get(0).get("business_date").toString();
+
+        final Map<Long, long[]> balance = new LinkedHashMap<>();
+
+        addToBalance(balance, jdbcTemplate.query("""
+                SELECT denomination_id, denomination_value, COALESCE(dm.kind, 'note') AS kind, count AS total_count
+                  FROM m_branch_day_register_detail d LEFT JOIN m_denomination_master dm ON dm.id = d.denomination_id
+                 WHERE d.register_id = ? AND d.leg = ? AND (d.teller_id IS NULL OR d.teller_id = ?)
+                """, DENOM_ROW, registerId, anchorLeg, tellerId), 1);
+
+        addToBalance(balance, jdbcTemplate.query("""
+                SELECT csd.denomination_id, csd.denomination_value, COALESCE(dm.kind, 'note') AS kind, SUM(csd.count) AS total_count
+                  FROM m_cash_settlement_detail csd JOIN m_cash_settlement cs ON cs.id = csd.settlement_id
+                  LEFT JOIN m_denomination_master dm ON dm.id = csd.denomination_id
+                 WHERE cs.to_teller_id = ? AND (cs.is_reversed IS NULL OR cs.is_reversed = false)
+                   AND cs.settlement_date >= CAST(? AS DATE) AND cs.settlement_date <= CAST(? AS DATE)
+                 GROUP BY csd.denomination_id, csd.denomination_value, dm.kind
+                """, DENOM_ROW, tellerId, anchorDate, dateFilter), 1);
+
+        addToBalance(balance, jdbcTemplate.query("""
+                SELECT ctd.denomination_id, ctd.denomination_value, COALESCE(dm.kind, 'note') AS kind, SUM(ctd.count) AS total_count
+                  FROM m_cash_transfer_detail ctd JOIN m_cash_transfer ct ON ct.id = ctd.transfer_id
+                  LEFT JOIN m_denomination_master dm ON dm.id = ctd.denomination_id
+                 WHERE ct.from_teller_id = ? AND (ct.is_reversed IS NULL OR ct.is_reversed = false)
+                   AND ct.transfer_date >= CAST(? AS DATE) AND ct.transfer_date <= CAST(? AS DATE)
+                 GROUP BY ctd.denomination_id, ctd.denomination_value, dm.kind
+                """, DENOM_ROW, tellerId, anchorDate, dateFilter), -1);
+
+        final List<Map<String, Object>> rows = new ArrayList<>();
+        balance.entrySet().stream().sorted((a, b) -> Long.compare(b.getValue()[0], a.getValue()[0])).forEach(e -> {
+            final Map<String, Object> row = new LinkedHashMap<>();
+            row.put("denominationId", e.getKey());
+            row.put("denominationValue", (int) e.getValue()[0]);
+            row.put("kind", e.getValue()[1] == 1L ? "coin" : "note");
+            row.put("count", e.getValue()[2]);
+            row.put("amount", BigDecimal.valueOf(e.getValue()[0] * e.getValue()[2]));
+            rows.add(row);
+        });
+
+        final BigDecimal totalAmount = rows.stream().map(r -> (BigDecimal) r.get("amount")).reduce(BigDecimal.ZERO,
+                BigDecimal::add);
+
+        result.put("hasBreakdown", true);
+        result.put("anchorDate", anchorDate);
+        result.put("totalAmount", totalAmount);
+        result.put("denominations", rows);
+        return result;
+    }
+
+    private void addToBalance(final Map<Long, long[]> balance, final List<Object[]> rows, final int sign) {
+        for (final Object[] row : rows) {
+            final Long denomId = (Long) row[0];
+            final int denomValue = (Integer) row[1];
+            final long kindFlag = "coin".equalsIgnoreCase((String) row[2]) ? 1L : 0L;
+            final long count = (Long) row[3];
+            final long[] entry = balance.computeIfAbsent(denomId, k -> new long[] { denomValue, kindFlag, 0L });
+            entry[2] += count * sign;
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashsettlement/api/CashSettlementApiResource.java

@@ -22,7 +22,9 @@ import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.portfolio.cashreport.api.CashReportApiResource;
 import org.apache.fineract.portfolio.cashreport.service.CashierRoleHelper;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
@@ -31,6 +33,8 @@ import org.apache.fineract.portfolio.cashsettlement.domain.CashSettlementDetail;
 import org.apache.fineract.portfolio.cashsettlement.domain.CashSettlementDetailRepository;
 import org.apache.fineract.portfolio.cashsettlement.domain.CashSettlementRepository;
 import org.apache.fineract.portfolio.teller.service.GlDispatchService;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
+import org.apache.fineract.portfolio.voucher.service.VoucherService;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.stereotype.Component;
 import org.springframework.transaction.PlatformTransactionManager;
@@ -41,6 +45,7 @@ import org.apache.fineract.infrastructure.core.service.DateUtils;
 @Path("/v1/cashsettlement")
 @Component
 @RequiredArgsConstructor
+@Slf4j
 @Consumes({ MediaType.APPLICATION_JSON })
 @Produces({ MediaType.APPLICATION_JSON })
 public class CashSettlementApiResource {
@@ -52,9 +57,22 @@ public class CashSettlementApiResource {
     private final PlatformTransactionManager transactionManager;
     private final JdbcTemplate jdbcTemplate;
     private final CashierRoleHelper cashierRoleHelper;
+    private final VoucherService voucherService;
+    // The same figure the Cashier Position screen shows, so a cashier cannot settle notes the report
+    // says they are not holding.
+    private final CashReportApiResource cashReportApiResource;
     private final Gson gson = new Gson();
 
+    // Transactional so the reconciliation precondition and the duplicate-settlement check below are
+    // read in the same transaction that writes the settlement. They used to run in autocommit while
+    // the insert happened later inside its own TransactionTemplate, leaving a window where a
+    // double-clicked Submit passed both checks twice and wrote two settlements for the same
+    // cashier/date -- each subtracted cumulatively, so the drawer read permanently negative by the
+    // settlement amount. Migration 0540 adds the unique index that makes the race impossible rather
+    // than merely unlikely; this annotation is what stops the two halves of the check-then-act from
+    // being separated by another request's commit.
     @POST
+    @Transactional
     public String create(String body) {
         context.authenticatedUser().validateHasPermissionTo("CREATE_CASHSETTLEMENT");
 
@@ -107,6 +125,8 @@ public class CashSettlementApiResource {
                     "At least one denomination with a positive count is required.");
         }
 
+        validateCashierHoldsDenominations(fromCashierId, denominations, settlementDate);
+
         final BigDecimal total = sumTotal(denominations);
 
         CashSettlement header = new CashSettlement();
@@ -285,6 +305,67 @@ public class CashSettlementApiResource {
         return total;
     }
 
+    /**
+     * Refuses a hand-over of notes the cashier is not holding.
+     *
+     * <p>
+     * Nothing stopped this before, and the damage is not a rejected screen but a drawer that reads
+     * negative for the rest of its life: a settlement is subtracted from the cashier's position
+     * cumulatively, so one settlement of cash they never had leaves every later position short by
+     * that amount, on every date, with no transaction to point at. This database carries exactly
+     * that — ₹10.5 lakh settled against ₹26 thousand ever allocated, and a Cashier Position screen
+     * showing counts like -1814 as a result.
+     *
+     * <p>
+     * Checked per denomination, not on the total, for the same reason the vault side is: a drawer
+     * holding ₹600 in one ₹500 and one ₹100 cannot hand over six ₹100 notes, though the total
+     * agrees. The holding comes from {@code buildPositionForCashier} — the figure the Cashier
+     * Position screen shows — so what a cashier is told they hold is what they are allowed to settle.
+     *
+     * <p>
+     * A cashier with no position at all is left alone: a first settlement on a drawer whose
+     * allocations were recorded without a breakdown has nothing to check against, and blocking it
+     * would stop a branch settling at all rather than prevent a mistake.
+     */
+    private void validateCashierHoldsDenominations(final Long fromCashierId, final JsonArray denominations,
+            final LocalDate settlementDate) {
+
+        final Map<String, Object> position = cashReportApiResource.buildPositionForCashier(fromCashierId,
+                settlementDate.toString());
+
+        @SuppressWarnings("unchecked")
+        final List<Map<String, Object>> heldRows = (List<Map<String, Object>>) position.get("denominations");
+        if (heldRows == null || heldRows.isEmpty()) {
+            return;
+        }
+
+        final Map<Long, Long> held = new java.util.HashMap<>();
+        for (final Map<String, Object> row : heldRows) {
+            final Object id = row.get("denominationId");
+            final Object count = row.get("count");
+            if (id instanceof Number && count instanceof Number) {
+                held.merge(((Number) id).longValue(), ((Number) count).longValue(), Long::sum);
+            }
+        }
+
+        for (final JsonElement el : denominations) {
+            final JsonObject item = el.getAsJsonObject();
+            final long count = item.has("count") && !item.get("count").isJsonNull() ? item.get("count").getAsLong() : 0;
+            if (count <= 0 || !item.has("denominationId") || item.get("denominationId").isJsonNull()) {
+                continue;
+            }
+            final long denominationId = item.get("denominationId").getAsLong();
+            final int denominationValue = item.has("denominationValue") && !item.get("denominationValue").isJsonNull()
+                    ? item.get("denominationValue").getAsInt() : 0;
+            final long available = held.getOrDefault(denominationId, 0L);
+            if (count > available) {
+                throw new PlatformDataIntegrityException("error.msg.cashsettlement.insufficient.cashier.denomination",
+                        "Cashier is not holding that much of denomination " + denominationValue + ": has " + available
+                                + ", settling " + count + ". Check the Cashier Position report before settling.");
+            }
+        }
+    }
+
     private boolean hasPositiveCount(JsonArray items) {
         for (JsonElement el : items) {
             if (el.getAsJsonObject().get("count").getAsInt() > 0) return true;

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashtransfer/api/CashTransferApiResource.java

@@ -24,6 +24,7 @@ import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
 import org.apache.fineract.portfolio.cashreport.service.CashierRoleHelper;
+import org.apache.fineract.portfolio.cashreport.service.VaultPositionService;
 import org.apache.fineract.portfolio.teller.service.GlDispatchService;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.cashtransfer.domain.CashTransfer;
@@ -52,6 +53,9 @@ public class CashTransferApiResource {
     private final PlatformTransactionManager transactionManager;
     private final JdbcTemplate jdbcTemplate;
     private final CashierRoleHelper cashierRoleHelper;
+    // The same source the Cash Transfer screen reads its Available column from, so what is offered
+    // and what is checked cannot disagree.
+    private final VaultPositionService vaultPositionService;
     private final Gson gson = new Gson();
 
     @POST
@@ -98,6 +102,8 @@ public class CashTransferApiResource {
                     "At least one denomination with a positive count is required.");
         }
 
+        validateVaultHasSufficientCash(fromTellerId, total, denominations, transferDate);
+
         CashTransfer header = new CashTransfer();
         header.setTransferDate(transferDate);
         header.setFromParty(fromParty);
@@ -264,6 +270,120 @@ public class CashTransferApiResource {
         return total;
     }
 
+    /**
+     * A vault can only hand out cash it is actually holding — in total, and note-by-note. The
+     * branch's business day carries an opening_cash figure forward each day (see
+     * BranchDayRegisterApiResource#lastClosingCash), so the vault's available balance for "today" is
+     * that opening figure, plus anything a cashier has already settled back into this same vault
+     * today, minus whatever this vault has already handed out to any cashier today. Reversed
+     * transfers/settlements don't count.
+     *
+     * No open business day for the vault's office means there is no opening_cash to check against, so
+     * the transfer is blocked outright rather than silently allowed against an unknown balance.
+     */
+    private void validateVaultHasSufficientCash(final Long fromTellerId, final BigDecimal requestedAmount,
+            final JsonArray denominations, final LocalDate transferDate) {
+        final Long officeId;
+        try {
+            officeId = jdbcTemplate.queryForObject("SELECT office_id FROM m_tellers WHERE id = ?", Long.class, fromTellerId);
+        } catch (Exception e) {
+            throw new PlatformDataIntegrityException("error.msg.cashtransfer.teller.not.found",
+                    "Vault/teller " + fromTellerId + " was not found.");
+        }
+
+        final LocalDate businessDate = transferDate != null ? transferDate : LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
+        final java.sql.Date sqlBusinessDate = java.sql.Date.valueOf(businessDate);
+
+        final List<Long> registerIds = jdbcTemplate.query("""
+                SELECT id FROM m_branch_day_register
+                 WHERE office_id = ? AND business_date = ? AND closed_at IS NULL
+                """, (rs, n) -> rs.getLong(1), officeId, sqlBusinessDate);
+        if (registerIds.isEmpty()) {
+            throw new PlatformDataIntegrityException("error.msg.cashtransfer.branchday.not.open",
+                    "The business day for this branch is not open for " + businessDate
+                            + ". Open the business day before allocating cash to a cashier.");
+        }
+        final Long registerId = registerIds.get(0);
+
+        final BigDecimal openingCash = jdbcTemplate.queryForObject(
+                "SELECT COALESCE(opening_cash, 0) FROM m_branch_day_register WHERE id = ?", BigDecimal.class, registerId);
+
+        final BigDecimal handedOutToday = jdbcTemplate.queryForObject("""
+                SELECT COALESCE(SUM(transfer_amount), 0) FROM m_cash_transfer
+                 WHERE from_teller_id = ? AND transfer_date = ? AND COALESCE(is_reversed, false) = false
+                """, BigDecimal.class, fromTellerId, sqlBusinessDate);
+
+        final BigDecimal settledBackToday = jdbcTemplate.queryForObject("""
+                SELECT COALESCE(SUM(settlement_amount), 0) FROM m_cash_settlement
+                 WHERE to_teller_id = ? AND settlement_date = ? AND COALESCE(is_reversed, false) = false
+                """, BigDecimal.class, fromTellerId, sqlBusinessDate);
+
+        final BigDecimal available = openingCash.add(settledBackToday).subtract(handedOutToday);
+        if (requestedAmount.compareTo(available) > 0) {
+            throw new PlatformDataIntegrityException("error.msg.cashtransfer.insufficient.vault.cash",
+                    "Insufficient vault cash: available " + available + ", requested " + requestedAmount + ".");
+        }
+
+        validateVaultHasSufficientDenominations(registerId, fromTellerId, denominations, sqlBusinessDate);
+    }
+
+    /**
+     * The total-amount check above can pass while a specific note/coin still runs short — a vault
+     * holding ₹1,00,000 entirely in ₹500 notes cannot hand out ₹50,000 in ₹10 notes even though the
+     * total is well within its balance. This checks each requested denomination against what the
+     * vault actually holds of it.
+     *
+     * <p>
+     * The holding comes from {@link VaultPositionService}, the same figure the Cash Transfer screen
+     * shows in its Available column. It has to: this check used to walk the register itself and read
+     * the branch-total {@code OPENING} leg, which mixes the vault with whatever every cashier under
+     * it is holding and is anchored on a different day. The screen offered a ₹100 note the vault
+     * plainly had and the transfer was then refused as "vault has 0" — two answers to one question,
+     * from two sources. Reading the service means the number that was offered is the number that is
+     * checked, and neither can drift from the other again.
+     *
+     * <p>
+     * A day with no breakdown recorded anywhere has nothing to check a denomination against, so this
+     * is skipped rather than blocking every transfer on a day that simply never captured one.
+     */
+    private void validateVaultHasSufficientDenominations(final Long registerId, final Long fromTellerId,
+            final JsonArray denominations, final java.sql.Date businessDate) {
+        final Map<String, Object> position = vaultPositionService.buildPositionForVault(fromTellerId, businessDate.toString());
+        if (!Boolean.TRUE.equals(position.get("hasBreakdown"))) {
+            return;
+        }
+
+        final Map<Long, Integer> available = new java.util.HashMap<>();
+        @SuppressWarnings("unchecked")
+        final List<Map<String, Object>> heldRows = (List<Map<String, Object>>) position.get("denominations");
+        if (heldRows != null) {
+            for (final Map<String, Object> row : heldRows) {
+                final Object id = row.get("denominationId");
+                final Object count = row.get("count");
+                if (id instanceof Number && count instanceof Number) {
+                    available.merge(((Number) id).longValue(), ((Number) count).intValue(), Integer::sum);
+                }
+            }
+        }
+
+        for (final JsonElement el : denominations) {
+            final JsonObject item = el.getAsJsonObject();
+            final int count = item.has("count") && !item.get("count").isJsonNull() ? item.get("count").getAsInt() : 0;
+            if (count <= 0 || !item.has("denominationId") || item.get("denominationId").isJsonNull()) {
+                continue;
+            }
+            final long denominationId = item.get("denominationId").getAsLong();
+            final int denominationValue = item.has("denominationValue") && !item.get("denominationValue").isJsonNull()
+                    ? item.get("denominationValue").getAsInt() : 0;
+            final int availableCount = available.getOrDefault(denominationId, 0);
+            if (count > availableCount) {
+                throw new PlatformDataIntegrityException("error.msg.cashtransfer.insufficient.vault.denomination",
+                        "Insufficient stock of denomination " + denominationValue + ": vault has " + availableCount
+                                + ", requested " + count + ".");
+            }
+        }
+    }
+
     private boolean hasPositiveCount(JsonArray items) {
         for (JsonElement el : items) {
             JsonObject item = el.getAsJsonObject();

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashtransfer/api/ShareCollectionApiResource.java

@@ -1,425 +0,0 @@
-package org.apache.fineract.portfolio.cashtransfer.api;
-
-import com.google.gson.Gson;
-import com.google.gson.JsonObject;
-import com.google.gson.JsonParser;
-import jakarta.ws.rs.Consumes;
-import jakarta.ws.rs.GET;
-import jakarta.ws.rs.POST;
-import jakarta.ws.rs.Path;
-import jakarta.ws.rs.PathParam;
-import jakarta.ws.rs.Produces;
-import jakarta.ws.rs.core.MediaType;
-import jakarta.ws.rs.core.Response;
-import java.math.BigDecimal;
-import java.time.LocalDate;
-import java.time.LocalDateTime;
-import java.time.ZoneOffset;
-import java.time.format.DateTimeParseException;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import lombok.RequiredArgsConstructor;
-import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
-import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
-import org.apache.fineract.useradministration.domain.AppUser;
-import org.springframework.dao.EmptyResultDataAccessException;
-import org.springframework.dao.IncorrectResultSizeDataAccessException;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.stereotype.Component;
-import org.springframework.transaction.annotation.Transactional;
-import org.apache.fineract.infrastructure.core.service.DateUtils;
-
-/**
- * Cashier Share Collection API — POST /v1/cashier/sharecollection
- *
- * Records cash received from a member for share purchase and posts GL entries:
- *   Dr  SHARES_REFERENCE (Cash at Vault)   = shareAmount + chargeAmount
- *   Cr  SHARES_SUSPENSE  (Share Sundry)    = shareAmount
- *   Cr  INCOME_FROM_FEES                   = chargeAmount  (if > 0)
- *
- * On account activation Fineract posts:
- *   Dr  SHARES_SUSPENSE  → Cr  SHARES_EQUITY
- * Activation skips charge GL if is_paid_derived = true (set here).
- */
-@Path("/v1/cashier/sharecollection")
-@Component
-@RequiredArgsConstructor
-@Consumes({ MediaType.APPLICATION_JSON })
-@Produces({ MediaType.APPLICATION_JSON })
-public class ShareCollectionApiResource {
-
-    // ── acc_gl_journal_entry.type_enum ─────────────────────────────────────
-    // Fineract convention: 1 = CREDIT (Cr), 2 = DEBIT (Dr)
-    // Opposite of intuition — verified from Fineract AccountingProcessorHelper.
-    private static final int DEBIT  = 2;
-    private static final int CREDIT = 1;
-
-    // ── CashAccountsForShares financial_account_type ───────────────────────
-    private static final int FA_SHARES_REFERENCE = 1;
-    private static final int FA_SHARES_SUSPENSE  = 2;
-    private static final int FA_INCOME_FROM_FEES = 3;
-
-    // ── acc_gl_journal_entry.entity_type_enum ─────────────────────────────
-    // Manual cashier entries use NULL — avoids NPE in PortfolioProductType.fromInt()
-    // which only handles values 1-5 and returns null for unknown values.
-
-    // ── acc_product_mapping.product_type for shares ────────────────────────
-    private static final int PRODUCT_TYPE_SHARES = 4;
-
-    // ── m_share_account.status_enum ───────────────────────────────────────
-    private static final int STATUS_SUBMITTED_PENDING = 100;
-
-    // ── Maximum days a collection record is considered valid ──────────────
-    private static final int MAX_COLLECTION_AGE_DAYS = 30;
-
-    private final PlatformSecurityContext context;
-    private final JdbcTemplate jdbcTemplate;
-    private final Gson gson = new Gson();
-
-    // ══════════════════════════════════════════════════════════════════════
-    // POST — Collect cash for a share account
-    // ══════════════════════════════════════════════════════════════════════
-    @POST
-    @Transactional
-    public Response collect(final String body) {
-
-        final AppUser currentUser = this.context.authenticatedUser();
-        currentUser.validateHasPermissionTo("CREATE_JOURNALENTRY");
-
-        // ── Parse request ──────────────────────────────────────────────────
-        if (body == null || body.isBlank()) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.request.empty",
-                    "Request body is required.");
-        }
-        final JsonObject json;
-        try {
-            json = JsonParser.parseString(body).getAsJsonObject();
-        } catch (Exception e) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.request.invalid",
-                    "Request body must be valid JSON.");
-        }
-
-        final Long       shareAccountId    = getLong(json,       "shareAccountId");
-        final String     transactionDateStr = getString(json,    "transactionDate");
-        final BigDecimal shareAmount        = getBigDecimal(json, "shareAmount",  "shareAmount");
-        final BigDecimal chargeAmountRaw    = getBigDecimal(json, "chargeAmount", "chargeAmount");
-        final String     note               = sanitiseNote(getString(json, "note"));
-
-        // ── Validate inputs ────────────────────────────────────────────────
-        if (shareAccountId == null) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.accountid.required",
-                    "shareAccountId is required.");
-        }
-        if (shareAmount.compareTo(BigDecimal.ZERO) < 0) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.shareamount.negative",
-                    "shareAmount cannot be negative.");
-        }
-        final BigDecimal safeCharge = chargeAmountRaw.compareTo(BigDecimal.ZERO) > 0
-                ? chargeAmountRaw : BigDecimal.ZERO;
-        final BigDecimal totalAmount = shareAmount.add(safeCharge);
-        if (totalAmount.compareTo(BigDecimal.ZERO) <= 0) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.total.zero",
-                    "Total collection amount must be greater than zero.");
-        }
-
-        final LocalDate entryDate;
-        try {
-            entryDate = transactionDateStr != null
-                    ? LocalDate.parse(transactionDateStr) : LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
-        } catch (DateTimeParseException e) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.date.invalid",
-                    "transactionDate must be in YYYY-MM-DD format. Received: " + transactionDateStr);
-        }
-
-        // ── Load account + client details ──────────────────────────────────
-        final Map<String, Object> acct = loadAccount(shareAccountId);
-
-        // ── Account must be in 'Submitted and pending approval' ───────────
-        final int statusEnum = toInt(acct.get("status_enum"));
-        if (statusEnum != STATUS_SUBMITTED_PENDING) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.account.invalid.status",
-                    "Cash collection is only allowed for accounts in 'Submitted and pending approval' "
-                    + "status. Account " + acct.get("account_no") + " has status code " + statusEnum + ".");
-        }
-
-        // ── Prevent double collection ──────────────────────────────────────
-        if (Boolean.TRUE.equals(acct.get("cashier_collected"))) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.already.collected",
-                    "Cash has already been collected for share account "
-                    + acct.get("account_no") + ". Re-collection is not allowed.");
-        }
-
-        final Long   officeId     = toLong(acct.get("office_id"));
-        final Long   productId    = toLong(acct.get("product_id"));
-        final String currencyCode = (String) acct.get("currency_code");
-        final String clientName   = (String) acct.get("client_name");
-        final String accountNo    = (String) acct.get("account_no");
-
-        // ── Resolve GL accounts from product mapping ───────────────────────
-        final Long glReference = resolveGl(productId, FA_SHARES_REFERENCE);
-        final Long glSuspense  = resolveGl(productId, FA_SHARES_SUSPENSE);
-        final Long glIncome    = resolveGl(productId, FA_INCOME_FROM_FEES);
-
-        if (glReference == null) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.gl.reference.notmapped",
-                    "Share Reference (Cash at Vault) GL is not mapped for product " + productId
-                    + ". Configure Share Product accounting mappings first.");
-        }
-        if (glSuspense == null) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.gl.suspense.notmapped",
-                    "Share Suspense GL is not mapped for product " + productId
-                    + ". Configure Share Product accounting mappings first.");
-        }
-        if (safeCharge.compareTo(BigDecimal.ZERO) > 0 && glIncome == null) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.gl.income.notmapped",
-                    "Income from Fees GL is not mapped for product " + productId
-                    + " but charge amount " + safeCharge + " is present. "
-                    + "Configure Share Product accounting mappings first.");
-        }
-
-        // ── Generate unique transaction ID ─────────────────────────────────
-        final String txnId = "SC-" + shareAccountId + "-" + System.currentTimeMillis();
-        final long userId = currentUser.getId();
-        final String collectorName = currentUser.getUsername();
-        final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
-
-        // ── Post GL journal entries ────────────────────────────────────────
-        // Dr Cash at Vault (SHARES_REFERENCE) = totalAmount
-        insertEntry(officeId, glReference, DEBIT, totalAmount, txnId,
-                entryDate, shareAccountId, userId, now, currencyCode,
-                "Share collection received for " + accountNo
-                + (note != null ? " | " + note : ""));
-
-        // Cr Share Sundry (SHARES_SUSPENSE) = shareAmount
-        insertEntry(officeId, glSuspense, CREDIT, shareAmount, txnId,
-                entryDate, shareAccountId, userId, now, currencyCode,
-                "Share amount held in suspense - " + accountNo);
-
-        // Cr Income from Fees = chargeAmount  (only if > 0)
-        if (safeCharge.compareTo(BigDecimal.ZERO) > 0) {
-            insertEntry(officeId, glIncome, CREDIT, safeCharge, txnId,
-                    entryDate, shareAccountId, userId, now, currencyCode,
-                    "Charge collected upfront for " + accountNo);
-
-            // Mark charges paid → activation will skip duplicate charge GL entry
-            jdbcTemplate.update(
-                    "UPDATE m_share_account_charge "
-                    + "SET is_paid_derived = true, "
-                    + "    amount_paid_derived = amount, "
-                    + "    amount_outstanding_derived = 0 "
-                    + "WHERE account_id = ? AND is_active = true AND is_paid_derived = false",
-                    shareAccountId);
-        }
-
-        // ── Flip cashier_collected flag ────────────────────────────────────
-        jdbcTemplate.update(
-                "UPDATE m_share_account SET cashier_collected = true WHERE id = ?",
-                shareAccountId);
-
-        // ── Insert audit / validation record ──────────────────────────────
-        jdbcTemplate.update(
-                "INSERT INTO m_share_cashier_collection "
-                + "(share_account_id, collected_by_user, collected_by_name, collection_date, "
-                + " share_amount, charge_amount, total_amount, gl_transaction_id, "
-                + " office_id, currency_code, note) "
-                + "VALUES (?,?,?,?,?,?,?,?,?,?,?)",
-                shareAccountId, userId, collectorName,
-                java.sql.Date.valueOf(entryDate),
-                shareAmount, safeCharge, totalAmount,
-                txnId, officeId, currencyCode, note);
-
-        // ── Build GL entries summary for response ──────────────────────────
-        final List<Map<String, Object>> glEntries = new ArrayList<>();
-        glEntries.add(glEntryMap(resolveGlName(glReference), "Dr", totalAmount, currencyCode));
-        glEntries.add(glEntryMap(resolveGlName(glSuspense),  "Cr", shareAmount, currencyCode));
-        if (safeCharge.compareTo(BigDecimal.ZERO) > 0) {
-            glEntries.add(glEntryMap(resolveGlName(glIncome), "Cr", safeCharge, currencyCode));
-        }
-
-        // ── Response ───────────────────────────────────────────────────────
-        final Map<String, Object> resp = new LinkedHashMap<>();
-        resp.put("transactionId",   txnId);
-        resp.put("shareAccountId",  shareAccountId);
-        resp.put("accountNo",       accountNo);
-        resp.put("clientName",      clientName);
-        resp.put("collectionDate",  entryDate.toString());
-        resp.put("collectedBy",     collectorName);
-        resp.put("shareAmount",     shareAmount);
-        resp.put("chargeAmount",    safeCharge);
-        resp.put("totalAmount",     totalAmount);
-        resp.put("currencyCode",    currencyCode);
-        resp.put("glEntries",       glEntries);
-
-        return Response.ok(gson.toJson(resp)).build();
-    }
-
-    // ══════════════════════════════════════════════════════════════════════
-    // GET — Check collection status for a share account
-    // ══════════════════════════════════════════════════════════════════════
-    @GET
-    @Path("/{shareAccountId}")
-    public Response getStatus(@PathParam("shareAccountId") final Long shareAccountId) {
-        this.context.authenticatedUser();
-
-        try {
-            final Map<String, Object> rec = jdbcTemplate.queryForMap(
-                    "SELECT scc.share_account_id, sa.account_no, "
-                    + "       mc.display_name AS client_name, "
-                    + "       scc.collected_by_name, scc.collection_date, "
-                    + "       scc.share_amount, scc.charge_amount, scc.total_amount, "
-                    + "       scc.gl_transaction_id, scc.currency_code, scc.note "
-                    + "FROM m_share_cashier_collection scc "
-                    + "JOIN m_share_account sa ON sa.id = scc.share_account_id "
-                    + "JOIN m_client mc ON mc.id = sa.client_id "
-                    + "WHERE scc.share_account_id = ?",
-                    shareAccountId);
-
-            final Map<String, Object> resp = new LinkedHashMap<>();
-            resp.put("collected",      true);
-            resp.put("shareAccountId", shareAccountId);
-            resp.put("accountNo",      rec.get("account_no"));
-            resp.put("clientName",     rec.get("client_name"));
-            resp.put("collectedBy",    rec.get("collected_by_name"));
-            resp.put("collectionDate", rec.get("collection_date") != null
-                    ? rec.get("collection_date").toString() : null);
-            resp.put("shareAmount",    rec.get("share_amount"));
-            resp.put("chargeAmount",   rec.get("charge_amount"));
-            resp.put("totalAmount",    rec.get("total_amount"));
-            resp.put("transactionId",  rec.get("gl_transaction_id"));
-            resp.put("currencyCode",   rec.get("currency_code"));
-            resp.put("note",           rec.get("note"));
-            return Response.ok(gson.toJson(resp)).build();
-
-        } catch (EmptyResultDataAccessException e) {
-            final Map<String, Object> resp = new LinkedHashMap<>();
-            resp.put("collected",      false);
-            resp.put("shareAccountId", shareAccountId);
-            return Response.ok(gson.toJson(resp)).build();
-        }
-    }
-
-    // ══════════════════════════════════════════════════════════════════════
-    // Private helpers
-    // ══════════════════════════════════════════════════════════════════════
-
-    private Map<String, Object> loadAccount(final Long shareAccountId) {
-        try {
-            return jdbcTemplate.queryForMap(
-                    "SELECT sa.id, sa.account_no, sa.status_enum, sa.product_id, "
-                    + "       sa.cashier_collected, sa.currency_code, "
-                    + "       mc.office_id, mc.display_name AS client_name "
-                    + "FROM m_share_account sa "
-                    + "JOIN m_client mc ON mc.id = sa.client_id "
-                    + "WHERE sa.id = ?",
-                    shareAccountId);
-        } catch (EmptyResultDataAccessException e) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.account.notfound",
-                    "Share account with id " + shareAccountId + " does not exist.");
-        }
-    }
-
-    private Long resolveGl(final Long productId, final int financialAccountType) {
-        try {
-            return jdbcTemplate.queryForObject(
-                    "SELECT gl_account_id FROM acc_product_mapping "
-                    + "WHERE product_id = ? AND product_type = ? AND financial_account_type = ?",
-                    Long.class, productId, PRODUCT_TYPE_SHARES, financialAccountType);
-        } catch (IncorrectResultSizeDataAccessException e) {
-            // covers both EmptyResultDataAccessException (0 rows) and multiple rows
-            return null;
-        }
-    }
-
-    private String resolveGlName(final Long glAccountId) {
-        if (glAccountId == null) return "Unknown GL";
-        try {
-            return jdbcTemplate.queryForObject(
-                    "SELECT name FROM acc_gl_account WHERE id = ?",
-                    String.class, glAccountId);
-        } catch (EmptyResultDataAccessException e) {
-            return "GL-" + glAccountId;
-        }
-    }
-
-    private void insertEntry(final Long officeId, final Long glAccountId,
-            final int typeEnum, final BigDecimal amount, final String txnId,
-            final LocalDate entryDate, final Long shareAccountId,
-            final long userId, final LocalDateTime now, final String currencyCode,
-            final String description) {
-        jdbcTemplate.update(
-                "INSERT INTO acc_gl_journal_entry "
-                + "(account_id, office_id, currency_code, transaction_id, reversed, manual_entry, "
-                + " entry_date, type_enum, amount, description, entity_id, "
-                + " created_by, last_modified_by, created_date, lastmodified_date, "
-                + " is_running_balance_calculated, office_running_balance, "
-                + " organization_running_balance, submitted_on_date, transaction_date, "
-                + " created_on_utc, last_modified_on_utc) "
-                + "VALUES (?,?,?,?,false,true,?,?,?,?,?,?,?,?,?,false,0,0,?,?,?,?)",
-                glAccountId, officeId, currencyCode, txnId,
-                java.sql.Date.valueOf(entryDate), typeEnum, amount, description,
-                shareAccountId,          // entity_id — links entry to the share account
-                userId, userId, now, now,
-                java.sql.Date.valueOf(entryDate),
-                java.sql.Date.valueOf(entryDate),
-                now.atOffset(ZoneOffset.UTC),
-                now.atOffset(ZoneOffset.UTC));
-    }
-
-    private Map<String, Object> glEntryMap(final String account, final String type,
-            final BigDecimal amount, final String currency) {
-        final Map<String, Object> m = new LinkedHashMap<>();
-        m.put("account",  account);
-        m.put("type",     type);
-        m.put("amount",   amount);
-        m.put("currency", currency);
-        return m;
-    }
-
-    private String sanitiseNote(final String raw) {
-        if (raw == null || raw.isBlank()) return null;
-        final String trimmed = raw.trim();
-        return trimmed.length() > 490 ? trimmed.substring(0, 490) : trimmed;
-    }
-
-    private Long toLong(final Object o) {
-        return o instanceof Number ? ((Number) o).longValue() : null;
-    }
-
-    private int toInt(final Object o) {
-        return o instanceof Number ? ((Number) o).intValue() : 0;
-    }
-
-    private Long getLong(final JsonObject json, final String key) {
-        return json.has(key) && !json.get(key).isJsonNull() ? json.get(key).getAsLong() : null;
-    }
-
-    private BigDecimal getBigDecimal(final JsonObject json, final String key,
-            final String fieldLabel) {
-        if (!json.has(key) || json.get(key).isJsonNull()) return BigDecimal.ZERO;
-        try {
-            return json.get(key).getAsBigDecimal();
-        } catch (NumberFormatException e) {
-            throw new PlatformDataIntegrityException(
-                    "error.msg.sharecollection.field.invalid.number",
-                    "Field '" + fieldLabel + "' must be a valid number.");
-        }
-    }
-
-    private String getString(final JsonObject json, final String key) {
-        return json.has(key) && !json.get(key).isJsonNull() ? json.get(key).getAsString() : null;
-    }
-}

fineract-provider/src/main/java/org/apache/fineract/portfolio/chequebook/service/ChequeBookIssuanceChargeService.java

@@ -35,6 +35,9 @@ import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.domain.FineractRequestContextHolder;
 import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
+import org.apache.fineract.portfolio.voucher.service.VoucherService;
 import org.apache.fineract.organisation.monetary.domain.Money;
 import org.apache.fineract.organisation.office.domain.Office;
 import org.apache.fineract.portfolio.charge.domain.Charge;
@@ -89,6 +92,12 @@ public class ChequeBookIssuanceChargeService {
     private final FineractRequestContextHolder fineractRequestContextHolder;
     private final SavingsAccountTransactionSummaryWrapper savingsAccountTransactionSummaryWrapper;
     private final SavingsHelper savingsHelper;
+    private final PlatformSecurityContext context;
+    private final VoucherService voucherService;
+
+    /** A cheque book issuance charge, keyed by its m_cheque_book id. */
+    private static final String REF_CHEQUEBOOK_CHARGE = "CHEQUEBOOK_CHARGE";
+
 
     /** The configured charge, if the admin has set one up — absent means "no charge configured yet." */
     private FacilityChargeMapping resolveMapping() {
@@ -244,6 +253,7 @@ public class ChequeBookIssuanceChargeService {
 
         postChargeJournalEntry(office.getId(), charge.getCurrencyCode(), today, ownAccountGlId, incomeGlId, chargeAmount, chequeBookId,
                 accountId);
+        raiseChargeVoucher(accountType, accountId, ownAccountGlId, incomeGlId, chargeAmount, chequeBookId);
         log.info("Deducted cheque book issuance charge {} from {} account {} for book {}", chargeAmount, accountType, accountId,
                 chequeBookId);
     }
@@ -278,6 +288,47 @@ public class ChequeBookIssuanceChargeService {
         this.currentAccountRepository.saveAndFlush(account);
     }
 
+    /**
+     * Records a cheque book issuance charge in the voucher register.
+     *
+     * The account is debited and the charge's income account credited — the society's fee, taken
+     * from the customer. The debit names the customer and their account number even though it posts
+     * against the product's control GL, so the slip reads as the customer's own.
+     *
+     * A failure here does not fail the charge. The money is already taken and the ledger already
+     * posted; reversing that over a slip would undo a correct deduction for a paperwork reason. The
+     * problem is logged and the charge stands.
+     */
+    private void raiseChargeVoucher(final ChequeAccountType accountType, final Long accountId, final Long ownAccountGlId,
+            final Long incomeGlId, final BigDecimal chargeAmount, final Long chequeBookId) {
+        try {
+            final Map<String, Object> holder = accountHolderForVoucher(accountType, accountId);
+            final Map<String, Object> incomeGl = this.voucherService.glAccount(incomeGlId);
+            final String narration = "Cheque book issuance charge - book #" + chequeBookId;
+
+            this.voucherService.createVoucherWithLines(VoucherService.TYPE_WITHDRAWAL, REF_CHEQUEBOOK_CHARGE, chequeBookId,
+                    this.context.authenticatedUser(), VoucherService.PREFIX_DEBIT,
+                    List.of(VoucherLine
+                            .debitGl(ownAccountGlId, (String) holder.get("party"), (String) holder.get("account_no"), chargeAmount)
+                            .withDescription(narration),
+                            VoucherLine
+                                    .creditGl(incomeGlId, (String) incomeGl.get("name"), (String) incomeGl.get("gl_code"), chargeAmount)
+                                    .withDescription(narration)));
+        } catch (final RuntimeException e) {
+            log.error("Could not raise a voucher for cheque book {} issuance charge", chequeBookId, e);
+        }
+    }
+
+    /** The customer and account number a charge is taken from, for printing on a voucher. */
+    private Map<String, Object> accountHolderForVoucher(final ChequeAccountType accountType, final Long accountId) {
+        final String sql = accountType == ChequeAccountType.SAVINGS
+                ? "SELECT sa.account_no, c.display_name AS party FROM m_savings_account sa "
+                        + "LEFT JOIN m_client c ON c.id = sa.client_id WHERE sa.id = ?"
+                : "SELECT ca.account_no, c.display_name AS party FROM m_current_account ca "
+                        + "LEFT JOIN m_client c ON c.id = ca.client_id WHERE ca.id = ?";
+        return this.jdbcTemplate.queryForList(sql, accountId).stream().findFirst().orElse(Map.of());
+    }
+
     /** Same shape as {@code getSavingsControlGlId}/{@code getCurrentControlGlId} in ClerkDisbursementRequestApiResource. */
     private Long getSavingsControlGlId(final Long savingsAccountId) {
         final List<Map<String, Object>> rows = this.jdbcTemplate.queryForList("SELECT apm.gl_account_id FROM m_savings_account sa "
@@ -320,7 +371,10 @@ public class ChequeBookIssuanceChargeService {
 
         final CommandWrapper cmd = new CommandWrapperBuilder().createJournalEntry().withJson(payload.toString()).build();
         this.fineractRequestContextHolder.setAttribute(SynchronousCommandProcessingService.COMMAND_SOURCE_ID, null);
-        final CommandProcessingResult result = this.commandsSourceWritePlatformService.logCommandSource(cmd);
+        // The charge raises its own voucher, naming the account charged and the fee; the journal
+        // command must not raise a second one over the same money.
+        final CommandProcessingResult result = this.voucherService
+                .withOwnVoucher(() -> this.commandsSourceWritePlatformService.logCommandSource(cmd));
         if (result == null) {
             log.warn("GL journal entry for cheque book {} issuance charge did not return a result.", chequeBookId);
             return;
@@ -335,8 +389,12 @@ public class ChequeBookIssuanceChargeService {
 
     /** Links the DEBIT row (type_enum=2) of this journal transaction to the customer's account so it shows an Account No. */
     private void linkDebitEntryToAccount(final String glTxnId, final Long accountId) {
+        // ORDER BY id DESC: prefer the most recently posted row for this transaction_id text, in
+        // case the id is ever reused (e.g. after a sequence reset) rather than latching onto a
+        // stale, unrelated journal entry.
         final List<Long> rowIds = this.jdbcTemplate.queryForList(
-                "SELECT id FROM acc_gl_journal_entry WHERE transaction_id = ? AND type_enum = 2 ORDER BY id ASC LIMIT 1", Long.class,
+                "SELECT id FROM acc_gl_journal_entry WHERE transaction_id = ? AND type_enum = 2 AND reversed = false"
+                + " ORDER BY id DESC LIMIT 1", Long.class,
                 glTxnId);
         if (!rowIds.isEmpty()) {
             this.jdbcTemplate.update("UPDATE acc_gl_journal_entry SET entity_type_enum = 2, entity_id = ? WHERE id = ?", accountId,

fineract-provider/src/main/java/org/apache/fineract/portfolio/clearing/api/ClearingGlConfigApiResource.java

@@ -0,0 +1,133 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.clearing.api;
+
+import com.google.gson.Gson;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Admin screen backing API for {@code m_clearing_gl_config}: which GL account backs each clearing
+ * role (CTS inward/outward suspense, NACH suspense, RTGS settlement, ...). The rows themselves are
+ * fixed — created by earlier migrations — so, like Facility Charge Mappings, this only ever reads
+ * them and updates which GL account one points at.
+ */
+@Path("/v1/clearingglconfig")
+@Component
+@RequiredArgsConstructor
+@Produces({ MediaType.APPLICATION_JSON })
+public class ClearingGlConfigApiResource {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final FromJsonHelper fromJsonHelper;
+    private final Gson gson = new Gson();
+
+    @GET
+    public String retrieveAll() {
+        this.context.authenticatedUser().validateHasReadPermission("CLEARINGGLCONFIG");
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT c.id, c.config_key, c.description, c.gl_account_id, a.name AS gl_account_name, a.gl_code
+                  FROM m_clearing_gl_config c LEFT JOIN acc_gl_account a ON a.id = c.gl_account_id
+                 ORDER BY c.config_key
+                """);
+        final List<Map<String, Object>> out = new ArrayList<>();
+        for (final Map<String, Object> row : rows) {
+            out.add(toResult(row));
+        }
+        return gson.toJson(out);
+    }
+
+    @GET
+    @Path("template")
+    public String template() {
+        this.context.authenticatedUser().validateHasReadPermission("CLEARINGGLCONFIG");
+        final List<Map<String, Object>> accounts = jdbcTemplate.queryForList("""
+                SELECT id, name, gl_code FROM acc_gl_account
+                 WHERE disabled = false AND manual_journal_entries_allowed = true
+                 ORDER BY name
+                """);
+        final List<Map<String, Object>> options = new ArrayList<>();
+        for (final Map<String, Object> a : accounts) {
+            final Map<String, Object> o = new LinkedHashMap<>();
+            o.put("id", a.get("id"));
+            o.put("name", a.get("name"));
+            o.put("glCode", a.get("gl_code"));
+            options.add(o);
+        }
+        return gson.toJson(Map.of("glAccountOptions", options));
+    }
+
+    @PUT
+    @Path("{configKey}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    public String update(@PathParam("configKey") final String configKey, final String body) {
+        this.context.authenticatedUser().validateHasPermissionTo("UPDATE_CLEARINGGLCONFIG");
+
+        final Integer exists = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_clearing_gl_config WHERE config_key = ?",
+                Integer.class, configKey);
+        if (exists == null || exists == 0) {
+            throw new PlatformDataIntegrityException("error.msg.clearingglconfig.not.found",
+                    "Clearing GL config key '" + configKey + "' was not found.");
+        }
+
+        final var root = this.fromJsonHelper.parse(body);
+        final Long glAccountId = this.fromJsonHelper.extractLongNamed("glAccountId", root);
+
+        if (glAccountId != null) {
+            final Integer accountExists = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM acc_gl_account WHERE id = ?",
+                    Integer.class, glAccountId);
+            if (accountExists == null || accountExists == 0) {
+                throw new PlatformDataIntegrityException("error.msg.clearingglconfig.gl.account.not.found",
+                        "GL account " + glAccountId + " was not found.");
+            }
+        }
+
+        jdbcTemplate.update("UPDATE m_clearing_gl_config SET gl_account_id = ? WHERE config_key = ?", glAccountId,
+                configKey);
+
+        return retrieveAll();
+    }
+
+    private Map<String, Object> toResult(final Map<String, Object> row) {
+        final Map<String, Object> out = new LinkedHashMap<>();
+        out.put("id", row.get("id"));
+        out.put("configKey", row.get("config_key"));
+        out.put("description", row.get("description"));
+        out.put("glAccountId", row.get("gl_account_id"));
+        out.put("glAccountName", row.get("gl_account_name"));
+        out.put("glCode", row.get("gl_code"));
+        return out;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/clearing/service/ClearingJournalService.java

@@ -24,6 +24,7 @@ import java.math.BigDecimal;
 import java.time.LocalDate;
 import java.time.format.DateTimeFormatter;
 import java.util.List;
+import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.fineract.commands.domain.CommandWrapper;
@@ -32,6 +33,9 @@ import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformS
 import org.apache.fineract.commands.service.SynchronousCommandProcessingService;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.domain.FineractRequestContextHolder;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
+import org.apache.fineract.portfolio.voucher.service.VoucherService;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Service;
 
@@ -49,6 +53,11 @@ public class ClearingJournalService {
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
     private final FineractRequestContextHolder fineractRequestContextHolder;
     private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final VoucherService voucherService;
+
+    /** A clearing posting — a CTS item, a NACH movement, a settlement — keyed by its GL transaction id. */
+    private static final String REF_CLEARING_POSTING = "CLEARING_POSTING";
 
     /**
      * Posts a single-debit / single-credit journal entry and returns the resulting GL transaction id (or null
@@ -57,6 +66,19 @@ public class ClearingJournalService {
      */
     public String postJournalEntry(final Long officeId, final String currencyCode, final LocalDate txnDate, final Long debitGlId,
             final Long creditGlId, final BigDecimal amount, final String comments, final Long linkAccountId) {
+        return postJournalEntry(officeId, currencyCode, txnDate, debitGlId, creditGlId, amount, comments, linkAccountId, null);
+    }
+
+    /**
+     * As above, naming the kind of account {@code linkAccountId} refers to — SAVINGS or CURRENT.
+     *
+     * Savings and current accounts number independently, so the same id exists in both tables and the id
+     * alone cannot say whose account it is. A caller that knows the type passes it and the voucher names
+     * the right customer; one that has no account at all — a settlement summary — passes neither.
+     */
+    public String postJournalEntry(final Long officeId, final String currencyCode, final LocalDate txnDate, final Long debitGlId,
+            final Long creditGlId, final BigDecimal amount, final String comments, final Long linkAccountId,
+            final String linkAccountType) {
         if (amount == null || amount.signum() <= 0 || debitGlId == null || creditGlId == null || officeId == null) {
             log.warn("Skipping clearing journal entry - missing office/GL/amount (office={}, dr={}, cr={}, amt={}).", officeId, debitGlId,
                     creditGlId, amount);
@@ -86,7 +108,10 @@ public class ClearingJournalService {
 
         final CommandWrapper cmd = new CommandWrapperBuilder().createJournalEntry().withJson(payload.toString()).build();
         this.fineractRequestContextHolder.setAttribute(SynchronousCommandProcessingService.COMMAND_SOURCE_ID, null);
-        final CommandProcessingResult result = this.commandsSourceWritePlatformService.logCommandSource(cmd);
+        // Clearing raises its own voucher below, naming the customer account the item belongs to;
+        // the journal command must not raise a second one over the same money.
+        final CommandProcessingResult result = this.voucherService
+                .withOwnVoucher(() -> this.commandsSourceWritePlatformService.logCommandSource(cmd));
         if (result == null) {
             log.warn("Clearing journal entry did not return a result ({}).", comments);
             return null;
@@ -95,12 +120,84 @@ public class ClearingJournalService {
         if (glTxnId != null && linkAccountId != null) {
             linkDebitEntryToAccount(glTxnId, linkAccountId);
         }
+        raiseClearingVoucher(glTxnId, debitGlId, creditGlId, amount, comments, linkAccountId, linkAccountType);
         return glTxnId;
     }
 
+    /**
+     * Records one clearing posting in the voucher register.
+     *
+     * Raised here rather than in each caller because CTS items, NACH movements and settlement
+     * summaries all post through this one path: a voucher per caller would be the same slip written
+     * three times, and one of them would drift.
+     *
+     * The caller's comment carries what the posting is — the item, the movement, the batch — so it
+     * becomes the narration on both sides. Where the caller named a customer account, the debit line
+     * carries that customer and account number; a settlement summary names no account and its lines
+     * stand on the GL names alone, which is what a summary is.
+     *
+     * A failure here does not fail the posting. The entry is already in the ledger, and clearing runs
+     * over batches where one unwritable slip must not take a whole settlement down with it. The
+     * problem is logged and the posting stands.
+     */
+    private void raiseClearingVoucher(final String glTxnId, final Long debitGlId, final Long creditGlId, final BigDecimal amount,
+            final String comments, final Long linkAccountId, final String linkAccountType) {
+        if (glTxnId == null) {
+            return;
+        }
+        try {
+            final Map<String, Object> debitGl = this.voucherService.glAccount(debitGlId);
+            final Map<String, Object> creditGl = this.voucherService.glAccount(creditGlId);
+            final Map<String, Object> holder = accountHolderForVoucher(linkAccountId, linkAccountType);
+
+            // The debit is the side a customer account is named against, matching the row this
+            // posting links to the account for reporting.
+            final String debitParty = holder.get("party") != null ? (String) holder.get("party") : (String) debitGl.get("name");
+            final String debitAccountNo = holder.get("account_no") != null ? (String) holder.get("account_no")
+                    : (String) debitGl.get("gl_code");
+
+            this.voucherService.createVoucherWithLines(VoucherService.TYPE_JOURNAL, REF_CLEARING_POSTING, null, glTxnId,
+                    this.context.authenticatedUser(), VoucherService.PREFIX_JOURNAL,
+                    List.of(VoucherLine.debitGl(debitGlId, debitParty, debitAccountNo, amount).withDescription(comments),
+                            VoucherLine.creditGl(creditGlId, (String) creditGl.get("name"), (String) creditGl.get("gl_code"), amount)
+                                    .withDescription(comments)));
+        } catch (final RuntimeException e) {
+            log.error("Could not raise a voucher for clearing journal transaction {}", glTxnId, e);
+        }
+    }
+
+    /**
+     * The customer and account number a clearing item belongs to, for printing on a voucher.
+     *
+     * The type decides which table to read: savings and current accounts number independently, so
+     * the same id exists in both and looking in the wrong one would put another customer's name on
+     * the slip. Empty when the caller named no account, as a settlement summary does, or named one
+     * without saying which kind — a wrong name is worse on a voucher than no name.
+     */
+    private Map<String, Object> accountHolderForVoucher(final Long accountId, final String accountType) {
+        if (accountId == null || accountType == null) {
+            return Map.of();
+        }
+        final String sql;
+        if ("SAVINGS".equalsIgnoreCase(accountType)) {
+            sql = "SELECT sa.account_no, c.display_name AS party FROM m_savings_account sa "
+                    + "LEFT JOIN m_client c ON c.id = sa.client_id WHERE sa.id = ?";
+        } else if ("CURRENT".equalsIgnoreCase(accountType)) {
+            sql = "SELECT ca.account_no, c.display_name AS party FROM m_current_account ca "
+                    + "LEFT JOIN m_client c ON c.id = ca.client_id WHERE ca.id = ?";
+        } else {
+            return Map.of();
+        }
+        return this.jdbcTemplate.queryForList(sql, accountId).stream().findFirst().orElse(Map.of());
+    }
+
     private void linkDebitEntryToAccount(final String glTxnId, final Long accountId) {
+        // ORDER BY id DESC: prefer the most recently posted row for this transaction_id text, in
+        // case the id is ever reused (e.g. after a sequence reset) rather than latching onto a
+        // stale, unrelated journal entry.
         final List<Long> rowIds = this.jdbcTemplate.queryForList(
-                "SELECT id FROM acc_gl_journal_entry WHERE transaction_id = ? AND type_enum = 2 ORDER BY id ASC LIMIT 1", Long.class,
+                "SELECT id FROM acc_gl_journal_entry WHERE transaction_id = ? AND type_enum = 2 AND reversed = false"
+                + " ORDER BY id DESC LIMIT 1", Long.class,
                 glTxnId);
         if (!rowIds.isEmpty()) {
             this.jdbcTemplate.update("UPDATE acc_gl_journal_entry SET entity_type_enum = 2, entity_id = ? WHERE id = ?", accountId,

fineract-provider/src/main/java/org/apache/fineract/portfolio/clerkdisbursement/api/ClerkDisbursementRequestApiResource.java

@@ -46,6 +46,7 @@ import java.time.OffsetDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.ArrayList;
 import java.util.LinkedHashSet;
+import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -65,6 +66,8 @@ import org.apache.fineract.infrastructure.core.domain.FineractRequestContextHold
 import org.apache.fineract.infrastructure.core.exception.IdempotentCommandProcessSucceedException;
 import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
+import org.apache.fineract.portfolio.client.service.KycRestrictionGuard;
 import org.apache.fineract.portfolio.voucher.service.VoucherService;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.jdbc.core.JdbcTemplate;
@@ -80,6 +83,7 @@ import org.apache.fineract.infrastructure.core.service.DateUtils;
 public class ClerkDisbursementRequestApiResource {
 
     private final JdbcTemplate jdbcTemplate;
+    private final KycRestrictionGuard kycRestrictionGuard;
     private final FromJsonHelper fromJsonHelper;
     private final PlatformSecurityContext context;
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
@@ -109,9 +113,15 @@ public class ClerkDisbursementRequestApiResource {
         final String creditEntriesJson = fromJsonHelper.extractStringNamed("creditEntries", root);
         String requestType = fromJsonHelper.extractStringNamed("requestType", root);
         if (requestType == null || requestType.isBlank()
-                || !java.util.Set.of("DISBURSEMENT", "COLLECTION", "BANK_TRANSFER").contains(requestType)) {
+                || !java.util.Set.of("DISBURSEMENT", "COLLECTION", "BANK_TRANSFER", "FUND_TRANSFER").contains(requestType)) {
             requestType = "DISBURSEMENT";
         }
+        // What this GL leg is actually for — a code value under "GLEntryType" (Admin > System >
+        // Manage Codes). A COLLECTION credits a GL account the counter picks by hand, the same
+        // ambiguity a cashier Receipt has (see CashierDepositRequestApiResource and
+        // 0565_convert_entry_type_to_code_value.xml). ShareAdvanceCollectionApiResource checks this
+        // before adopting one of these rows as a share collection.
+        final Long entryTypeCvId = resolveEntryTypeCvId(fromJsonHelper.extractLongNamed("entryTypeCvId", root));
 
         if (creditEntriesJson == null || creditEntriesJson.isBlank()) {
             throw apiError(400, "At least one entry is required");
@@ -141,6 +151,32 @@ public class ClerkDisbursementRequestApiResource {
             if (!entry.has("accountNo") || entry.get("accountNo").getAsString().isBlank()) {
                 throw apiError(400, "Each entry must have an account number");
             }
+            // Whatever the counter searched with to find this account (often a short suffix, not the
+            // full number) is not what belongs on this record permanently — replace it here, once, at
+            // submit time, with the real number looked up from the id the search actually resolved.
+            // Leaves the entry's own accountNo untouched only when it carries no id to look up from
+            // (a GL leg's account/glAccountId is set, so this only bites when the search itself never
+            // matched anything, which submit-time validation elsewhere is already responsible for).
+            final String entryAccountType = entry.has("accountType") ? entry.get("accountType").getAsString() : "SAVINGS";
+            final boolean entryIsGl = "GL".equals(entryAccountType);
+            final String realAccountNo = entryIsGl
+                    ? (entry.has("glAccountId") && !entry.get("glAccountId").isJsonNull()
+                            ? glCodeOf(entry.get("glAccountId").getAsLong())
+                            : null)
+                    : (entry.has("savingsAccountId") && !entry.get("savingsAccountId").isJsonNull()
+                            ? nonGlAccountNoOf(entryAccountType, entry.get("savingsAccountId").getAsLong())
+                            : null);
+            if (realAccountNo != null) {
+                entry.addProperty("accountNo", realAccountNo);
+            }
+            // Checked by the direction of the leg. A Dr leg takes money out of the account and is
+            // stopped once the restriction ladder stops debits; a Cr leg pays money in and keeps
+            // working, since nothing about a restricted customer should prevent them being paid.
+            // A GL leg carries no savingsAccountId and the guard ignores it.
+            if (entry.has("savingsAccountId") && !entry.get("savingsAccountId").isJsonNull()) {
+                kycRestrictionGuard.check(entry.get("savingsAccountId").getAsLong(),
+                        "Dr".equals(dbCr) ? KycRestrictionGuard.Operation.TRANSFER : KycRestrictionGuard.Operation.CREDIT);
+            }
             if ("Dr".equals(dbCr)) {
                 totalDr = totalDr.add(entryAmt);
             } else {
@@ -168,26 +204,50 @@ public class ClerkDisbursementRequestApiResource {
 
         final String activityLog = buildActivityLog(null, "SUBMITTED", currentUser.getUsername(), null);
 
+        // Same correction as each entry above, for the request's own top-level GL — and the entries
+        // are stored from the mutated array (each accountNo now the real one), not the original
+        // as-submitted JSON string.
+        final String realGlAccountNo = Optional.ofNullable(glCodeOf(glAccountId)).orElse(glAccountNo);
+        final String correctedCreditEntriesJson = gson.toJson(creditEntries);
+
         final Long newId = jdbcTemplate.queryForObject("""
                 INSERT INTO m_clerk_disbursement_request
                 (gl_account_id, gl_account_no, gl_account_name, dr_amount, office_id, currency_code,
                  credit_entries, payment_type_id, payment_type_name, description,
-                 status, clerk_id, clerk_name, clerk_username, activity_log, submitted_at, request_type)
-                VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+                 status, clerk_id, clerk_name, clerk_username, activity_log, submitted_at, request_type, entry_type_cv_id)
+                VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
                 RETURNING id
                 """,
             Long.class,
-            glAccountId, glAccountNo, glAccountName, txnAmount,
+            glAccountId, realGlAccountNo, glAccountName, txnAmount,
             officeId != null ? officeId : currentUser.getOffice().getId(), currencyCode,
-            creditEntriesJson, paymentTypeId, paymentTypeName, description,
+            correctedCreditEntriesJson, paymentTypeId, paymentTypeName, description,
             "PENDING",
             currentUser.getId(), currentUser.getDisplayName(), currentUser.getUsername(),
-            activityLog, Timestamp.from(Instant.now()), requestType
+            activityLog, Timestamp.from(Instant.now()), requestType, entryTypeCvId
         );
 
+        // A collection pulls money into the GL, so it reads as a credit; a disbursement moves
+        // money out of the source side, so it reads as a debit — but only when the TXN TP. the
+        // clerk actually picked is Cash. That dropdown is the real-world signal for whether notes
+        // cross the counter, the same way it already governs every teller screen in this system
+        // (isCashPayment): a clerk who selects Transfer, Cheque, DD or NEFT/RTGS is saying no cash
+        // moves for this request, whatever GL it happens to post against, so it belongs in the
+        // Journal series instead of being counted as real cash received or paid on My Vouchers.
+        final boolean isCashPayment = paymentTypeId != null && Boolean.TRUE.equals(jdbcTemplate.queryForObject(
+            "SELECT is_cash_payment FROM m_payment_type WHERE id = ?", Boolean.class, paymentTypeId));
+        final String voucherPrefix = !isCashPayment ? VoucherService.PREFIX_JOURNAL
+            : "COLLECTION".equals(requestType) ? VoucherService.PREFIX_CREDIT : VoucherService.PREFIX_DEBIT;
+        // The voucher's own TYPE column used to be hard-coded to VoucherService.TYPE_DISBURSEMENT
+        // for every request this register raises, so My Vouchers showed "DISBURSEMENT" even for a
+        // Collection or a Fund Transfer the clerk had explicitly picked a different TYPE for on the
+        // entry screen — the one place this register's actual four-way distinction ought to have
+        // been visible was throwing it away. Stored as the clerk's own requestType instead, in the
+        // same words the TYPE dropdown already uses.
+        final String voucherTypeLabel = voucherTypeLabelFor(requestType);
         final String voucherNo = voucherService.createVoucher(
-            VoucherService.TYPE_DISBURSEMENT, VoucherService.REF_CLERK_DISBURSEMENT_REQUEST,
-            newId, txnAmount, currentUser);
+            voucherTypeLabel, VoucherService.REF_CLERK_DISBURSEMENT_REQUEST,
+            newId, txnAmount, currentUser, voucherPrefix);
         jdbcTemplate.update(
             "UPDATE m_clerk_disbursement_request SET voucher_no = ? WHERE id = ?", voucherNo, newId);
 
@@ -252,7 +312,7 @@ public class ClerkDisbursementRequestApiResource {
             + " credit_entries, payment_type_name, description,"
             + " clerk_id, clerk_name, clerk_username,"
             + " manager_id, manager_name, manager_username,"
-            + " rejection_reason, txn_refs, error_message, submitted_at, actioned_at"
+            + " rejection_reason, txn_refs, error_message, submitted_at, actioned_at, entry_type_cv_id"
             + " FROM m_clerk_disbursement_request " + where
             + " ORDER BY submitted_at DESC LIMIT ? OFFSET ?",
             pageParams.toArray());
@@ -319,7 +379,7 @@ public class ClerkDisbursementRequestApiResource {
         final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
             "SELECT id, voucher_no, status, request_type, gl_account_no, gl_account_name, dr_amount,"
             + " credit_entries, payment_type_name, description, clerk_name,"
-            + " manager_name, rejection_reason, txn_refs, error_message, submitted_at, actioned_at"
+            + " manager_name, rejection_reason, txn_refs, error_message, submitted_at, actioned_at, entry_type_cv_id"
             + " FROM m_clerk_disbursement_request " + where
             + " ORDER BY submitted_at DESC LIMIT ? OFFSET ?",
             pageParams.toArray());
@@ -443,6 +503,11 @@ public class ClerkDisbursementRequestApiResource {
         final List<String> withdrawalSavingsTxnRefs = new ArrayList<>();
         BigDecimal withdrawalSavingsTotal = BigDecimal.ZERO;
         Long collectionTargetGlId = null;
+        // The real acc_gl_journal_entry.transaction_id this approval posts -- captured here because
+        // nothing else on the row remembers it otherwise (txn_refs only holds the account-side
+        // transaction ids). Whoever needs the actual GL posting afterwards (Share Advance Collection
+        // adopting a tagged voucher, a GL detail view) reads it back from gl_transaction_id.
+        String approvedGlTxnId = null;
 
         // Savings-control GL data per account for the direct combined journal entry.
         // collectionGlEntries:   DR SavingsControl per savings account (collection/withdrawal mode).
@@ -508,6 +573,7 @@ public class ClerkDisbursementRequestApiResource {
                         linkGlEntriesToSavingsAccounts(btGlTxnId, btDebitGlEntries, 2);
                         linkGlEntriesToSavingsAccounts(btGlTxnId, btCreditGlEntries, 1);
                     }
+                    approvedGlTxnId = btGlTxnId;
 
                     // Audit log in m_bank_transfer_log
                     final String btTxnRefsStr = String.join(",", txnRefs);
@@ -544,7 +610,7 @@ public class ClerkDisbursementRequestApiResource {
                         return ps;
                     }, btLogKh);
                     final long btLogId = Objects.requireNonNull(btLogKh.getKey()).longValue();
-                    final String btVoucherNo = generateBtVoucherNo(btLogId);
+                    final String btVoucherNo = generateBtVoucherNo(btLogId, currentUser, finalBtTotal);
                     jdbcTemplate.update("UPDATE m_bank_transfer_log SET voucher_no = ? WHERE id = ?", btVoucherNo, btLogId);
                 }
 
@@ -653,6 +719,7 @@ public class ClerkDisbursementRequestApiResource {
                     if (disbGlTxnId != null) {
                         linkGlEntriesToSavingsAccounts(disbGlTxnId, disbursementGlEntries, 1);
                     }
+                    approvedGlTxnId = disbGlTxnId;
                 }
 
                 // ── Collection GL entry ───────────────────────────────────────────────
@@ -675,11 +742,18 @@ public class ClerkDisbursementRequestApiResource {
                         if (collGlTxnId != null) {
                             linkGlEntriesToSavingsAccounts(collGlTxnId, collectionGlEntries, 2);
                         }
+                        approvedGlTxnId = collGlTxnId;
                     } else {
                         final Long cashVaultGlId = findCashVaultGlId(withdrawalSavingsTxnRefs, 1);
                         if (cashVaultGlId != null) {
-                            postGlOffsetEntry(cashVaultGlId, collectionTargetGlId, withdrawalSavingsTotal,
+                            approvedGlTxnId = postGlOffsetEntry(cashVaultGlId, collectionTargetGlId, withdrawalSavingsTotal,
                                 officeId, currencyCode, txnDateStr, description);
+                        } else if (!withdrawalSavingsTxnRefs.isEmpty()) {
+                            // No bridging entry was needed: the withdrawal's own auto-posted credit
+                            // leg already lands on the target GL directly (the savings product's own
+                            // payment-type mapping points there). That withdrawal's own transaction is
+                            // therefore the real posting -- there is no second one to remember instead.
+                            approvedGlTxnId = "S" + withdrawalSavingsTxnRefs.get(0);
                         }
                     }
                 }
@@ -715,17 +789,22 @@ public class ClerkDisbursementRequestApiResource {
             throw apiError(422, "Approval processing failed. All partial transactions have been reversed. Check the request for details.");
         }
 
+        // The sides of the slip, built from the entries as approved. Only reached once every
+        // posting above has succeeded, so the voucher describes a completed movement rather than
+        // one that was attempted.
+        addDisbursementVoucherLines(record, creditEntries, sourceGlId, requestType);
+
         final String txnRefsStr = String.join(",", txnRefs);
         final String updatedLog = buildActivityLog(
             (String) record.get("activity_log"), "APPROVED", currentUser.getUsername(), null);
         jdbcTemplate.update("""
                 UPDATE m_clerk_disbursement_request SET
                   status = 'APPROVED', manager_id = ?, manager_name = ?, manager_username = ?,
-                  txn_refs = ?, activity_log = ?, actioned_at = ?
+                  txn_refs = ?, gl_transaction_id = ?, activity_log = ?, actioned_at = ?
                 WHERE id = ?
                 """,
             currentUser.getId(), currentUser.getDisplayName(), currentUser.getUsername(),
-            txnRefsStr, updatedLog, Timestamp.from(Instant.now()), id);
+            txnRefsStr, approvedGlTxnId, updatedLog, Timestamp.from(Instant.now()), id);
 
         final JsonObject res = new JsonObject();
         res.addProperty("resourceId", id);
@@ -981,7 +1060,7 @@ public class ClerkDisbursementRequestApiResource {
             return ps;
         }, logKh);
         final long logId = Objects.requireNonNull(logKh.getKey()).longValue();
-        final String voucherNo = generateBtVoucherNo(logId);
+        final String voucherNo = generateBtVoucherNo(logId, currentUser, finalTotalDr);
         jdbcTemplate.update("UPDATE m_bank_transfer_log SET voucher_no = ? WHERE id = ?", voucherNo, logId);
 
         final JsonObject res = new JsonObject();
@@ -997,9 +1076,28 @@ public class ClerkDisbursementRequestApiResource {
      * Uses MAX(id) of the just-inserted row (passed in) to guarantee uniqueness even
      * under concurrent inserts on the same date.
      */
-    private String generateBtVoucherNo(final long logId) {
-        return "BT" + LocalDate.now(DateUtils.getDateTimeZoneOfTenant()).format(DateTimeFormatter.ofPattern("yyMMdd"))
-            + String.format("%05d", logId);
+    /**
+     * Bank-transfer settlement voucher, drawn from the same central register as every other
+     * voucher so the two numbering schemes cannot drift apart.
+     *
+     * Numbered Journal rather than Debit: both sides of a bank transfer are member accounts, and
+     * the money never touches Cash in Hand or the vault either way (see the "no CashVault entry
+     * created anywhere" comments where these accounts are debited/credited directly). A DR number
+     * would have read as real cash paid out, double-counting the figure in My Vouchers on top of
+     * the day's actual Payment total.
+     */
+    private String generateBtVoucherNo(final long logId, final AppUser currentUser, final BigDecimal amount) {
+        return voucherService.createVoucher(
+            "Bank Transfer", VoucherService.REF_BANK_TRANSFER_LOG,
+            logId, amount, currentUser, VoucherService.PREFIX_JOURNAL);
+    }
+
+    /** The TYPE column's label, in the same words the clerk's own TYPE dropdown uses for it. */
+    private static String voucherTypeLabelFor(final String requestType) {
+        if ("COLLECTION".equals(requestType)) return "Collection";
+        if ("BANK_TRANSFER".equals(requestType)) return "Bank Transfer";
+        if ("FUND_TRANSFER".equals(requestType)) return "Fund Transfer";
+        return "Disbursement";
     }
 
     // ── Helpers ───────────────────────────────────────────────────────────────────
@@ -1032,13 +1130,159 @@ public class ClerkDisbursementRequestApiResource {
         );
     }
 
+    /**
+     * Records the sides of an approved disbursement, collection or bank transfer on its voucher.
+     *
+     * The register covers three directions under one request type, and each puts the society's GL
+     * on a different side:
+     *
+     * <ul>
+     * <li>DISBURSEMENT — money out of the source GL into the listed accounts: GL debited, each
+     * account credited.</li>
+     * <li>COLLECTION — money into the target GL out of the listed accounts: each account debited,
+     * GL credited.</li>
+     * <li>BANK_TRANSFER — account to account with no GL involved at all; each entry already carries
+     * its own side, so they are used as given.</li>
+     * </ul>
+     *
+     * The society's side is written as a single line for the total rather than one per counterparty,
+     * because that is how it posts and how the slip reads.
+     *
+     * A failure here does not fail the approval: every transaction is posted by this point, and the
+     * money has moved. The problem is logged, and the voucher keeps its number without sides.
+     */
+    /** The GL account's own code, looked up fresh from its id -- never trust a caller-supplied string
+     *  for what belongs on a voucher's GL-side line. Null-safe so a possibly-missing id passes through. */
+    private String glCodeOf(final Long glAccountId) {
+        if (glAccountId == null) {
+            return null;
+        }
+        return jdbcTemplate.queryForList("SELECT gl_code FROM acc_gl_account WHERE id = ?", String.class, glAccountId).stream()
+                .findFirst().orElse(null);
+    }
+
+    /** The account's own account number, looked up fresh from its id -- same reasoning as
+     *  {@link #glCodeOf}, for the non-GL side of a voucher line. The id travels in this entry's
+     *  {@code savingsAccountId} field regardless of what kind of account it actually names (this
+     *  request's JSON has no separate field per account type), but "CURRENT" accounts live in their
+     *  own {@code m_current_account} table with their own id space -- looking every non-GL id up
+     *  against {@code m_savings_account} would silently return an unrelated savings account's number
+     *  whenever the two id spaces happened to collide, which is worse than the truncated-search-string
+     *  bug this method exists to fix. Every other non-GL type (savings, fixed deposit, recurring
+     *  deposit) is a {@code m_savings_account} row distinguished only by {@code deposit_type_enum}. */
+    private String nonGlAccountNoOf(final String accountType, final Long accountId) {
+        if (accountId == null) {
+            return null;
+        }
+        final String table = "CURRENT".equalsIgnoreCase(accountType) ? "m_current_account" : "m_savings_account";
+        return jdbcTemplate.queryForList("SELECT account_no FROM " + table + " WHERE id = ?", String.class, accountId).stream()
+                .findFirst().orElse(null);
+    }
+
+    private void addDisbursementVoucherLines(final Map<?, ?> record, final JsonArray creditEntries, final Long sourceGlId,
+            final String requestType) {
+
+        final String voucherNo = (String) record.get("voucher_no");
+        if (voucherNo == null || voucherNo.isBlank()) {
+            return;
+        }
+
+        try {
+            final boolean isBankTransfer = "BANK_TRANSFER".equals(requestType);
+            final boolean isCollection = "COLLECTION".equals(requestType);
+
+            final List<VoucherLine> lines = new ArrayList<>();
+            BigDecimal counterpartyTotal = BigDecimal.ZERO;
+
+            for (final JsonElement el : creditEntries) {
+                final JsonObject entry = el.getAsJsonObject();
+                final String accountType = entry.has("accountType") ? entry.get("accountType").getAsString() : "SAVINGS";
+                final boolean isGlEntry = "GL".equals(accountType);
+
+                // For a Disbursement/Collection, the society's own GL side is added once as a single
+                // total further down (from sourceGlId, the actually-resolved id) -- not read per entry
+                // here. A Collection's payload names its GL leg inside creditEntries too (so the
+                // amounts balance for the request's own DR/CR validation at submit time), but if this
+                // loop also turned that same entry into a line, the GL account would be posted twice on
+                // one voucher: once here (wrongly signed, since entryIsDebit below ignores this entry's
+                // own dbCr and applies isCollection to every entry in the array) and again as the
+                // society's side, with counterpartyTotal inflated by the GL entry's own amount on top of
+                // it. A bank transfer has no separate society side and every entry, GL or not, is a real
+                // leg of the transfer, so nothing is skipped there.
+                if (!isBankTransfer && isGlEntry) {
+                    continue;
+                }
+
+                final BigDecimal entryAmount = new BigDecimal(entry.get("amount").getAsString());
+                final String enteredAccountNo = entry.has("accountNo") ? entry.get("accountNo").getAsString() : null;
+                final String accountName = entry.has("accountName") && !entry.get("accountName").isJsonNull()
+                        ? entry.get("accountName").getAsString()
+                        : enteredAccountNo;
+
+                final Long glId = isGlEntry && entry.has("glAccountId") && !entry.get("glAccountId").isJsonNull()
+                        ? entry.get("glAccountId").getAsLong()
+                        : null;
+                final Long savingsId = !isGlEntry && entry.has("savingsAccountId") && !entry.get("savingsAccountId").isJsonNull()
+                        ? entry.get("savingsAccountId").getAsLong()
+                        : null;
+
+                // Whatever the counter searched with to find this account (often a short suffix, not
+                // the full number) is never what belongs on the slip. The id is what was actually
+                // resolved and posted against, so look its real number up from the database rather
+                // than trust the string the client happened to submit alongside it -- the id is the
+                // only part of this entry that can't be typo'd or truncated.
+                final String accountNo = isGlEntry ? Optional.ofNullable(glCodeOf(glId)).orElse(enteredAccountNo)
+                        : Optional.ofNullable(nonGlAccountNoOf(accountType, savingsId)).orElse(enteredAccountNo);
+
+                // A bank transfer states each side on the entry itself; the other two directions
+                // put every counterparty on the side opposite the society's GL.
+                final boolean entryIsDebit = isBankTransfer
+                        ? "Dr".equals(entry.has("dbCr") ? entry.get("dbCr").getAsString() : "Cr")
+                        : isCollection;
+
+                final VoucherLine line;
+                if (isGlEntry) {
+                    line = entryIsDebit ? VoucherLine.debitGl(glId, accountName, accountNo, entryAmount)
+                            : VoucherLine.creditGl(glId, accountName, accountNo, entryAmount);
+                } else {
+                    line = entryIsDebit ? VoucherLine.debitSavings(savingsId, accountName, accountNo, entryAmount)
+                            : VoucherLine.creditSavings(savingsId, accountName, accountNo, entryAmount);
+                }
+                lines.add(line);
+
+                if (!isBankTransfer) {
+                    counterpartyTotal = counterpartyTotal.add(entryAmount);
+                }
+            }
+
+            // The society's own side. A bank transfer has none — the money never leaves the members
+            // between them — so its entries already balance on their own.
+            if (!isBankTransfer) {
+                final String glName = (String) record.get("gl_account_name");
+                // Same reasoning as above: gl_account_no is whatever string was stored on this request
+                // at submit time, not necessarily this GL account's real code. sourceGlId is what was
+                // actually resolved and posted against.
+                final String glNo = Optional.ofNullable(glCodeOf(sourceGlId)).orElse((String) record.get("gl_account_no"));
+                lines.add(isCollection ? VoucherLine.creditGl(sourceGlId, glName, glNo, counterpartyTotal)
+                        : VoucherLine.debitGl(sourceGlId, glName, glNo, counterpartyTotal));
+            }
+
+            // Debits first, so the voucher prints the way a slip is read.
+            lines.sort(Comparator.comparing(VoucherLine::isDebit).reversed());
+
+            voucherService.addLines(voucherNo, lines);
+        } catch (final RuntimeException e) {
+            log.error("Could not record voucher lines for disbursement request voucher {}", voucherNo, e);
+        }
+    }
+
     private Map<?, ?> loadRecord(final Long id) {
         final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
                 SELECT id, voucher_no, status, request_type, gl_account_id, gl_account_no, gl_account_name, dr_amount,
                        office_id, currency_code, credit_entries, payment_type_id, payment_type_name,
                        description, clerk_id, clerk_name, clerk_username,
                        manager_id, manager_name, manager_username, rejection_reason,
-                       txn_refs, error_message, activity_log, submitted_at, actioned_at
+                       txn_refs, error_message, activity_log, submitted_at, actioned_at, entry_type_cv_id
                 FROM m_clerk_disbursement_request WHERE id = ?
                 """, id);
         if (rows.isEmpty()) {
@@ -1097,6 +1341,18 @@ public class ClerkDisbursementRequestApiResource {
         try { return new BigDecimal(raw); } catch (NumberFormatException e) { return null; }
     }
 
+    /** The counter's choice, when they made one — otherwise "General" under the GLEntryType code,
+     *  resolved by name rather than a hardcoded id since Manage Codes owns these rows now. */
+    private Long resolveEntryTypeCvId(final Long provided) {
+        if (provided != null) {
+            return provided;
+        }
+        return jdbcTemplate.queryForObject(
+            "SELECT cv.id FROM m_code_value cv JOIN m_code c ON c.id = cv.code_id"
+                + " WHERE c.code_name = 'GLEntryType' AND cv.code_value = 'General'",
+            Long.class);
+    }
+
     private String buildActivityLog(final String existingJson, final String action,
             final String username, final String note) {
         JsonArray log = new JsonArray();
@@ -1142,7 +1398,13 @@ public class ClerkDisbursementRequestApiResource {
             .withJson(payload.toString())
             .build();
         fineractRequestContextHolder.setAttribute(SynchronousCommandProcessingService.COMMAND_SOURCE_ID, null);
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(cmd);
+        // This disbursement/collection request already raised its own voucher at submission and
+        // attaches every leg to it in addDisbursementVoucherLines() after approval succeeds — without
+        // withOwnVoucher() the plain savings withdrawal command below raises a second, orphaned
+        // voucher of its own for the same money (see VoucherService.withOwnVoucher's javadoc), which
+        // is what was double-counting a Collection's amount in both Received and Payments on My Vouchers.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(cmd));
         return result.getResourceId() != null ? result.getResourceId().toString() : null;
     }
 
@@ -1170,9 +1432,12 @@ public class ClerkDisbursementRequestApiResource {
 
     private Long findCashVaultGlId(final List<String> txnRefs, final int typeEnum) {
         for (final String txnRef : txnRefs) {
+            // ORDER BY id DESC: if transaction_id text is ever reused (e.g. after a sequence
+            // reset), always prefer the most recently posted matching row over a stale one.
             final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
                 "SELECT account_id FROM acc_gl_journal_entry"
-                + " WHERE transaction_id = ? AND type_enum = ? LIMIT 1",
+                + " WHERE transaction_id = ? AND type_enum = ? AND reversed = false"
+                + " ORDER BY id DESC LIMIT 1",
                 "S" + txnRef, typeEnum);
             if (!rows.isEmpty()) {
                 return ((Number) rows.get(0).get("account_id")).longValue();
@@ -1181,7 +1446,15 @@ public class ClerkDisbursementRequestApiResource {
         return null;
     }
 
-    private void postGlOffsetEntry(
+    /**
+     * @return the real {@code acc_gl_journal_entry.transaction_id} this posts, so a caller that needs
+     *         to remember which posting was theirs — the collection fallback below, most importantly
+     *         — is not left with nothing to record. Returning it here rather than discarding it, as
+     *         this method used to, was the entire reason {@code gl_transaction_id} stayed blank on
+     *         every clerk collection that fell back to this path: nothing downstream (Share Advance
+     *         Collection's GL-detail popup among them) had anything to look the posting up by.
+     */
+    private String postGlOffsetEntry(
             final Long drGlAccountId, final Long crGlAccountId,
             final BigDecimal amount, final Long officeId,
             final String currencyCode, final String txnDateStr, final String comments) {
@@ -1216,7 +1489,10 @@ public class ClerkDisbursementRequestApiResource {
             .withJson(payload.toString())
             .build();
         fineractRequestContextHolder.setAttribute(SynchronousCommandProcessingService.COMMAND_SOURCE_ID, null);
-        commandsSourceWritePlatformService.logCommandSource(cmd);
+        // The disbursement register raises its own voucher; suppress the journal command's own.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(cmd));
+        return result != null ? result.getTransactionId() : null;
     }
 
     // ── Combined GL entry helpers ─────────────────────────────────────────────
@@ -1250,9 +1526,12 @@ public class ClerkDisbursementRequestApiResource {
      * typeEnum=2 (DEBIT)  → SavingsControl for withdrawals (DR SavingsControl / CR CashVault).
      */
     private Long findAccountGlFromTxn(final String fullTxnId, final int typeEnum) {
+        // ORDER BY id DESC: prefer the most recently posted row for this transaction_id text,
+        // in case the id is ever reused (e.g. after a sequence reset).
         final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
             "SELECT account_id FROM acc_gl_journal_entry"
-            + " WHERE transaction_id = ? AND type_enum = ? LIMIT 1",
+            + " WHERE transaction_id = ? AND type_enum = ? AND reversed = false"
+            + " ORDER BY id DESC LIMIT 1",
             fullTxnId, typeEnum);
         return rows.isEmpty() ? null : ((Number) rows.get(0).get("account_id")).longValue();
     }
@@ -1265,8 +1544,11 @@ public class ClerkDisbursementRequestApiResource {
     private void markTxnGlEntriesReversed(final List<GlEntry> entries) {
         for (final GlEntry e : entries) {
             if (e.txnId != null) {
+                // Guarded by reversed = false: if transaction_id text is ever reused, this can
+                // only flip rows that are currently live, never re-touch an already-reversed
+                // unrelated transaction's rows.
                 jdbcTemplate.update(
-                    "UPDATE acc_gl_journal_entry SET reversed = true WHERE transaction_id = ?",
+                    "UPDATE acc_gl_journal_entry SET reversed = true WHERE transaction_id = ? AND reversed = false",
                     e.txnId);
             }
         }
@@ -1277,7 +1559,7 @@ public class ClerkDisbursementRequestApiResource {
         for (final GlEntry e : entries) {
             if (e.txnId != null) {
                 jdbcTemplate.update(
-                    "UPDATE acc_gl_journal_entry SET reversed = false WHERE transaction_id = ?",
+                    "UPDATE acc_gl_journal_entry SET reversed = false WHERE transaction_id = ? AND reversed = true",
                     e.txnId);
             }
         }
@@ -1290,9 +1572,15 @@ public class ClerkDisbursementRequestApiResource {
      */
     private void linkGlEntriesToSavingsAccounts(final String glTxnId,
             final List<GlEntry> entries, final int typeEnum) {
+        // Take only the most recently posted `entries.size()` rows for this transaction_id text,
+        // then restore ascending id order. If the id text is ever reused (e.g. after a sequence
+        // reset), this keeps the positional zip below scoped to the rows this call itself just
+        // posted, instead of silently pulling in an older, unrelated combined entry's rows.
         final List<Long> rowIds = jdbcTemplate.queryForList(
-            "SELECT id FROM acc_gl_journal_entry WHERE transaction_id = ? AND type_enum = ? ORDER BY id ASC",
-            Long.class, glTxnId, typeEnum);
+            "SELECT id FROM acc_gl_journal_entry WHERE transaction_id = ? AND type_enum = ? AND reversed = false"
+            + " ORDER BY id DESC LIMIT ?",
+            Long.class, glTxnId, typeEnum, entries.size());
+        java.util.Collections.reverse(rowIds);
         for (int i = 0; i < Math.min(rowIds.size(), entries.size()); i++) {
             final Long savingsAccId = entries.get(i).savingsAccountId;
             if (savingsAccId != null) {
@@ -1653,7 +1941,10 @@ public class ClerkDisbursementRequestApiResource {
             .withJson(payload.toString())
             .build();
         fineractRequestContextHolder.setAttribute(SynchronousCommandProcessingService.COMMAND_SOURCE_ID, null);
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(cmd);
+        // The disbursement register raises its own voucher, naming every account involved; the
+        // journal command must not raise a second one over the same money.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(cmd));
         return result != null ? result.getTransactionId() : null;
     }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/clerkwithdrawal/api/ClerkWithdrawalRequestApiResource.java

@@ -54,7 +54,12 @@ import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformS
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.client.domain.KycExpiryStage;
+import org.apache.fineract.portfolio.client.service.KycRestrictionGuard;
+import org.apache.fineract.portfolio.voucher.service.VoucherLine;
 import org.apache.fineract.portfolio.voucher.service.VoucherService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Component;
@@ -69,7 +74,12 @@ import com.google.common.base.Splitter;
 @RequiredArgsConstructor
 public class ClerkWithdrawalRequestApiResource {
 
+    // Named LOG rather than declared with @Slf4j: buildActivityLog uses a local "log" for the
+    // activity JsonArray, and a field of the same name reads as that variable at a glance.
+    private static final Logger LOG = LoggerFactory.getLogger(ClerkWithdrawalRequestApiResource.class);
+
     private final JdbcTemplate jdbcTemplate;
+    private final KycRestrictionGuard kycRestrictionGuard;
     private final FromJsonHelper fromJsonHelper;
     private final PlatformSecurityContext context;
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
@@ -114,6 +124,7 @@ public class ClerkWithdrawalRequestApiResource {
             throw apiError(400, "Token number (TOK. NO.) is required");
         }
         validateTokenUniqueToday(tokNo, null);
+        kycRestrictionGuard.check(savingsAccountId, KycRestrictionGuard.Operation.DEBIT);
 
         final String activityLog = buildActivityLog(null, "SUBMITTED", currentUser.getUsername(), null);
 
@@ -151,7 +162,8 @@ public class ClerkWithdrawalRequestApiResource {
             @QueryParam("offset") @DefaultValue("0") final int offset,
             @QueryParam("limit") @DefaultValue("20") final int limit,
             @QueryParam("fromDate") final String fromDate,
-            @QueryParam("toDate") final String toDate) {
+            @QueryParam("toDate") final String toDate,
+            @QueryParam("search") final String search) {
 
         final StringBuilder where = new StringBuilder("WHERE status = ?");
         final List<Object> baseParams = new ArrayList<>(List.of(status));
@@ -163,6 +175,14 @@ public class ClerkWithdrawalRequestApiResource {
             where.append(" AND DATE(submitted_at) <= ?");
             baseParams.add(Date.valueOf(toDate));
         }
+        if (search != null && !search.isBlank()) {
+            where.append(" AND (account_no ILIKE ? OR client_name ILIKE ? OR voucher_no ILIKE ? OR tok_no ILIKE ?)");
+            final String like = "%" + search.trim() + "%";
+            baseParams.add(like);
+            baseParams.add(like);
+            baseParams.add(like);
+            baseParams.add(like);
+        }
 
         final long total = Optional.ofNullable(
             jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_clerk_withdrawal_request " + where, Long.class, baseParams.toArray())
@@ -437,6 +457,11 @@ public class ClerkWithdrawalRequestApiResource {
 
         final Long savingsAccountId = record.get("savings_account_id") != null
             ? ((Number) record.get("savings_account_id")).longValue() : null;
+        // Checked again on approval, not only on submission: a request can sit in the queue for days,
+        // and the account can cross the dormancy threshold while it waits. The savings withdrawal
+        // below refuses a dormant account anyway, but that failure would surface to the manager as a
+        // rejected transaction after the approval was recorded; this says why, before anything moves.
+        kycRestrictionGuard.check(savingsAccountId, KycRestrictionGuard.Operation.DEBIT);
         final BigDecimal amount = new BigDecimal(record.get("amount").toString());
         final Object ptId = record.get("payment_type_id");
         final Object txnDateObj = record.get("txn_date");
@@ -457,6 +482,10 @@ public class ClerkWithdrawalRequestApiResource {
                 VoucherService.REF_CLERK_WITHDRAWAL_REQUEST, id, Long.valueOf(txnId));
         }
 
+        // The sides of the slip. A withdrawal is money leaving the member, so their account is
+        // debited and the till that pays it out is credited.
+        addWithdrawalVoucherLines(record, savingsAccountId, amount, txnId);
+
         final String updatedLog = buildActivityLog(
             (String) record.get("activity_log"), "APPROVED", currentUser.getUsername(), null
         );
@@ -594,6 +623,11 @@ public class ClerkWithdrawalRequestApiResource {
             throw apiError(409, "This withdrawal has already been withdrawn by another cashier. Double disbursement prevented.");
         }
 
+        // The voucher was raised in the clerk's name at submission, before any cashier was involved --
+        // reattribute it to whoever is actually handing over the cash now, so it shows up in their own
+        // voucher register rather than only in the clerk's.
+        voucherService.updateCashier(VoucherService.REF_CLERK_WITHDRAWAL_REQUEST, id, currentUser);
+
         // Record denomination breakdown in m_savings_txn_denomination so cashier vault position updates
         if (denominationData != null && !denominationData.isBlank()) {
             saveDisbursementDenomination(denominationData, record, currentUser);
@@ -663,6 +697,7 @@ public class ClerkWithdrawalRequestApiResource {
         final String accountNo = (String) record.get("account_no");
         final Object clientIdObj = record.get("client_id");
         final Long clientId = clientIdObj != null ? Long.valueOf(clientIdObj.toString()) : null;
+        final String paymentTypeName = (String) record.get("payment_type_name");
 
         for (final Map.Entry<String, com.google.gson.JsonElement> entry : denomMap.entrySet()) {
             final int count;
@@ -686,16 +721,75 @@ public class ClerkWithdrawalRequestApiResource {
             jdbcTemplate.update("""
                 INSERT INTO m_savings_txn_denomination
                 (txn_id, savings_account_id, account_no, client_id, denomination_id,
-                 denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'WITHDRAWAL', ?, ?)
+                 denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username, payment_type)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'WITHDRAWAL', ?, ?, ?)
                 """,
                 txnId, savingsAccountId, accountNo, clientId, denomId,
                 value, count, BigDecimal.valueOf((long) value * count),
-                cashier.getId(), cashier.getUsername()
+                cashier.getId(), cashier.getUsername(), paymentTypeName
             );
         }
     }
 
+    /**
+     * Records the two sides of an approved withdrawal on its voucher.
+     *
+     * Money leaves the member and is paid out over the counter, so the member's account is debited
+     * and the till is credited. The till side can't be resolved from config the way a Share or
+     * Closure withdrawal's cash leg can: which GL Fineract's native withdrawal command actually
+     * credits depends on the request's own payment type (Cash, Cheque, DD, ...) via its Fund Source
+     * mapping, which this class does not re-derive. Reading back what was actually posted for this
+     * transaction (see resolveTillGlFromSavingsTxn()) names it accurately for any payment type;
+     * "Cash in Hand" with no GL only remains the label where that lookup finds nothing (a current
+     * account withdrawal, or a tenant with accounting off).
+     *
+     * A failure here does not fail the approval: the withdrawal is already posted and the member
+     * already paid. The problem is logged, and the voucher keeps its number without sides.
+     */
+    private void addWithdrawalVoucherLines(final Map<?, ?> record, final Long savingsAccountId, final BigDecimal amount,
+            final String savingsTxnId) {
+        final String voucherNo = (String) record.get("voucher_no");
+        if (voucherNo == null || voucherNo.isBlank() || savingsAccountId == null) {
+            return;
+        }
+
+        try {
+            final Map<String, Object> tillGl = resolveTillGlFromSavingsTxn(savingsTxnId);
+            voucherService.addLines(voucherNo,
+                    List.of(VoucherLine.debitSavings(savingsAccountId, (String) record.get("client_name"),
+                            (String) record.get("account_no"), amount),
+                            tillGl == null ? VoucherLine.creditGl(null, "Cash in Hand", null, amount)
+                                    : VoucherLine.creditGl(((Number) tillGl.get("id")).longValue(), (String) tillGl.get("name"),
+                                            (String) tillGl.get("code"), amount)));
+        } catch (final RuntimeException e) {
+            LOG.error("Could not record voucher lines for withdrawal request voucher {}", voucherNo, e);
+        }
+    }
+
+    /** The GL account Fineract's native withdrawal command actually credited for this savings
+     *  transaction — looked up by the {@code savings_transaction_id} FK on {@code
+     *  acc_gl_journal_entry} rather than assumed, since the real posting depends on the withdrawal's
+     *  own payment type. Returns null (falls back to a generic label) for a current-account
+     *  withdrawal, which has no savings transaction to match, or a tenant with accounting off. */
+    private Map<String, Object> resolveTillGlFromSavingsTxn(final String savingsTxnId) {
+        if (savingsTxnId == null) {
+            return null;
+        }
+        final Long id;
+        try {
+            id = Long.valueOf(savingsTxnId);
+        } catch (final NumberFormatException e) {
+            return null;
+        }
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT g.id, g.name, g.gl_code AS code FROM acc_gl_journal_entry je
+                  JOIN acc_gl_account g ON g.id = je.account_id
+                 WHERE je.savings_transaction_id = ? AND je.type_enum = 1 AND je.reversed = false
+                 LIMIT 1
+                """, id);
+        return rows.isEmpty() ? null : rows.get(0);
+    }
+
     private Map<?, ?> loadRecord(final Long id) {
         final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
                 SELECT id, account_no, account_type, savings_account_id, client_id, client_name,
@@ -736,7 +830,13 @@ public class ClerkWithdrawalRequestApiResource {
             .withJson(payload.toString())
             .build();
 
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        // The withdrawal register raised its own voucher at submission and attaches the member and
+        // till sides to it on approval, so the savings command must not raise a second one over the
+        // same money -- one withdrawal was appearing twice on the cashier's payment report, once
+        // under the register's number and once under the savings transaction's, doubling the day's
+        // cash paid out.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(commandRequest));
         return result.getResourceId() != null ? result.getResourceId().toString() : null;
     }
 
@@ -764,7 +864,11 @@ public class ClerkWithdrawalRequestApiResource {
             .withJson(payload.toString())
             .build();
 
-        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        // Suppressed for the same reason as the savings path above. Current accounts raise no
+        // voucher of their own today, so this changes nothing now; it is here so that the day one
+        // is added, this register does not silently start double-counting again.
+        final CommandProcessingResult result = voucherService
+            .withOwnVoucher(() -> commandsSourceWritePlatformService.logCommandSource(commandRequest));
         return result.getResourceId() != null ? result.getResourceId().toString() : null;
     }
 
@@ -798,9 +902,9 @@ public class ClerkWithdrawalRequestApiResource {
 
     /**
      * Ensures the token number is unique for today's date among non-rejected requests, checking
-     * both this table and {@code m_share_dividend_claim_request} -- a dividend cash claim's token
-     * is redeemed at the very same Transaction Entry field, so the two pools must never collide.
-     * {@code excludeId} is set during resubmit to skip the record being edited.
+     * this table plus {@code m_share_dividend_claim_request} and {@code m_clerk_closure_request} --
+     * all three are redeemed at the very same Transaction Entry token field, so none of the pools
+     * may ever collide. {@code excludeId} is set during resubmit to skip the record being edited.
      */
     private void validateTokenUniqueToday(final String tokNo, final Long excludeId) {
         final StringBuilder sql = new StringBuilder(
@@ -815,13 +919,19 @@ public class ClerkWithdrawalRequestApiResource {
         final long ownCount = Optional.ofNullable(
             jdbcTemplate.queryForObject(sql.toString(), Long.class, params.toArray())
         ).orElse(0L);
-        final long otherCount = Optional.ofNullable(
+        final long dividendCount = Optional.ofNullable(
             jdbcTemplate.queryForObject(
                 "SELECT COUNT(*) FROM m_share_dividend_claim_request "
                 + "WHERE tok_no = ? AND CAST(submitted_at AS DATE) = CURRENT_DATE AND status <> 'REJECTED'",
                 Long.class, tokNo)
         ).orElse(0L);
-        if (ownCount + otherCount > 0) {
+        final long closureCount = Optional.ofNullable(
+            jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_clerk_closure_request "
+                + "WHERE tok_no = ? AND CAST(submitted_at AS DATE) = CURRENT_DATE AND status <> 'REJECTED'",
+                Long.class, tokNo)
+        ).orElse(0L);
+        if (ownCount + dividendCount + closureCount > 0) {
             throw apiError(400,
                 "Token number '" + tokNo + "' is already used today. Please enter a different token number.");
         }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/api/ClientAllAccountsApiResource.java

@@ -0,0 +1,404 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.api;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonObject;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.time.LocalDate;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.fineract.infrastructure.core.domain.FineractPlatformTenant;
+import org.apache.fineract.infrastructure.core.domain.JdbcSupport;
+import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
+import org.apache.fineract.infrastructure.security.apiclient.ApiClientCredentialService;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.savings.data.SavingsAccountStatusEnumData;
+import org.apache.fineract.portfolio.savings.service.SavingsEnumerations;
+import org.springframework.dao.EmptyResultDataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.stereotype.Component;
+
+/**
+ * A single client's active deposit accounts (Savings/Fixed Deposit/Recurring Deposit/Current -- Share
+ * accounts are out of scope for this endpoint, see below), looked up by client number OR mobile number
+ * (the path segment is tried as {@code m_client.account_no} first, then {@code m_client.mobile_no})
+ * rather than the internal client id -- these are what a counter clerk has on the slip, or what a
+ * third-party caller was given, respectively, so no separate client-search step is needed before this
+ * call. Built so the whole thing, including the client lookup itself, resolves in a small handful of
+ * index-scan-only queries.
+ *
+ * Deliberately narrow on purpose:
+ * <ul>
+ * <li>Only ACTIVE accounts (status_enum 300) are returned -- a closed, pending, or rejected account is
+ * not part of "what does this client currently hold", which is the question this endpoint answers.</li>
+ * <li>No balance/currentValue/onHoldFunds figures at all, for any account type -- this is an account
+ * listing, not a balance enquiry; a caller that needs the money figure is expected to hit the
+ * account-specific balance endpoint for it (kept as a smaller, separate, cacheable concern rather than
+ * mixed into every listing response).</li>
+ * <li>Share accounts are excluded entirely -- they carry no balance in the deposit sense (approved
+ * shares x unit price is a valuation, not a balance) and don't belong in a "deposit accounts" listing.</li>
+ * </ul>
+ *
+ * Branch details (name, code, address, pincode, IFSC, MICR -- see {@code m_office_profile}, migrations
+ * 0511-0513/0538) and bank details (name, SWIFT/BIC, registered address, contact -- see
+ * {@code m_institution_profile}) are included on every response: a caller resolving "which branch/bank
+ * is this client's account actually at" (for a passbook header, a cheque book request, a KYC document)
+ * would otherwise need two more round trips, to {@code /v1/branchprofile/{officeId}} and
+ * {@code /v1/institutionprofile}.
+ *
+ * Deliberately its own lightweight resource rather than a reuse of {@code AccountSummaryCollectionData}
+ * (GET /clients/{clientId}/accounts): that endpoint's row mappers each carry six LEFT JOINs to
+ * m_appuser for a full submitted/approved/rejected/activated/closed audit trail per account, which this
+ * caller doesn't need. Fewer joins and fewer columns is what actually makes this fast, not a different
+ * query engine.
+ *
+ * Two ways in, deliberately: a normal Fineract user (Basic Auth, unchanged) can call this exactly as
+ * they do every other endpoint; a third-party integration that should never see a Fineract username or
+ * password sends an {@code X-Api-Key} header instead (see {@link ApiClientCredentialService}), minted
+ * via {@code POST /v1/apiclients} by a super user. This path is carved out as {@code permitAll()} in
+ * {@code SecurityConfig} for exactly that second case -- the same posture this fork already uses for the
+ * IMPS and NPCI receivers, where Spring Security's outer gate stays open for one narrow path and the
+ * handler itself is what actually authenticates the caller.
+ */
+@Path("/v1/clientaccounts")
+@Component
+@Tag(name = "Client All Accounts", description = "Fast, single-lookup view of a client's ACTIVE Savings/Fixed Deposit/Recurring Deposit/Current accounts (no balances, no Share accounts) plus their branch details, by client number or mobile number.")
+@RequiredArgsConstructor
+public class ClientAllAccountsApiResource {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final ApiClientCredentialService apiClientCredentialService;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    // Same header-precedence list CallerIpTrackingFilter uses elsewhere in this fork, kept local
+    // rather than depending on that filter bean: it's only conditionally registered
+    // (fineract.ip-tracking.enabled), and an API-key IP allowlist has to work regardless of whether
+    // that unrelated feature toggle is on.
+    private static final String[] IP_HEADER_CANDIDATES = { "X-Forwarded-For", "Proxy-Client-IP", "WL-Proxy-Client-IP" };
+
+    // ACTIVE-only status filter: 300 is SavingsAccountStatusType.ACTIVE, and m_current_account reuses
+    // the same status_enum numbering (see AccountDetailsReadPlatformServiceJpaRepositoryImpl for the
+    // same convention elsewhere in this codebase). One UNION ALL, one round trip: SB/FD/RD
+    // (m_savings_account, split by deposit_type_enum) and CD (m_current_account, its own table --
+    // current accounts were never folded into m_savings_account here). Every leg filters on
+    // client_id, which is indexed on both tables (fksa00000000000001, idx_ca_client_id) -- an
+    // index-only lookup per leg, not a scan.
+    private static final String ACCOUNTS_SQL = """
+            SELECT sa.deposit_type_enum AS deposit_type, sa.id AS account_id, sa.account_no, sa.external_id,
+                   sa.status_enum AS status_enum, sa.currency_code, sa.product_id,
+                   p.name AS product_name, p.short_name AS short_product_name,
+                   sa.submittedon_date AS submitted_date, sa.activatedon_date AS activated_date
+              FROM m_savings_account sa
+              JOIN m_savings_product p ON p.id = sa.product_id
+             WHERE sa.client_id = ? AND sa.status_enum = 300
+
+            UNION ALL
+
+            SELECT CAST(400 AS smallint) AS deposit_type, ca.id, ca.account_no, ca.external_id,
+                   ca.status_enum, ca.currency_code, ca.product_id, cp.name, cp.short_name,
+                   ca.submittedon_date, ca.activatedon_date
+              FROM m_current_account ca
+              JOIN m_current_product cp ON cp.id = ca.product_id
+             WHERE ca.client_id = ? AND ca.status_enum = 300
+            """;
+
+    // Branch details for the client's own office -- name, code, address, pincode, IFSC, MICR -- so a
+    // caller doesn't need a second round trip to /v1/branchprofile/{officeId} just to print a passbook
+    // header or route a cheque book request. LEFT JOIN: an office with no m_office_profile row yet
+    // (see BranchProfileApiResource) is a valid, ordinary state, not an error -- the profile fields
+    // just come back null.
+    private static final String BRANCH_SQL = """
+            SELECT o.id AS office_id, o.name AS office_name, p.branch_code, p.branch_type, p.address,
+                   p.pincode, p.ifsc_code, p.micr_code, p.contact_phone, p.contact_email
+              FROM m_office o LEFT JOIN m_office_profile p ON p.office_id = o.id
+             WHERE o.id = ?
+            """;
+
+    // The bank itself (m_institution_profile, see InstitutionProfileApiResource) -- a singleton row,
+    // id=1, one per tenant. Only the fields a caller printing a passbook/statement header or routing a
+    // payment actually needs: identity, SWIFT/BIC (the institution-level counterpart to a branch's
+    // IFSC/MICR), registered address, and contact. Deliberately leaves out the authorised-representative
+    // block and terms-and-conditions text -- regulatory-filing detail, not account-lookup detail -- and
+    // the created/updated audit columns, which are an internal concern of the Bank Profile screen, not
+    // this endpoint's caller.
+    private static final String BANK_SQL = """
+            SELECT bank_name, legal_name, short_name, bank_code, swift_bic,
+                   address_line1, address_line2, city, district, state, pincode,
+                   contact_phone, contact_email, customer_care_number, website
+              FROM m_institution_profile WHERE id = 1
+            """;
+
+    @GET
+    @Path("/{identifier}")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String retrieveByIdentifier(@PathParam("identifier") final String identifier,
+            @HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest) {
+        // Dual-mode: a header present means a third-party caller, checked against m_api_client and
+        // never touching Fineract's own login. No header means an ordinary logged-in user -- exactly
+        // the same authenticatedUser() gate every other resource in this codebase uses. The two are
+        // mutually exclusive on purpose: a request carrying an API key is never also allowed to fall
+        // back to "well, maybe they're logged in too" -- that would let a stolen key ride along on a
+        // legitimate session's cookies/headers.
+        if (StringUtils.isNotBlank(apiKey)) {
+            apiClientCredentialService.authenticate(apiKey, resolveClientIp(servletRequest));
+        } else {
+            context.authenticatedUser();
+        }
+
+        final FineractPlatformTenant tenant = ThreadLocalContextUtil.getTenant();
+        final Map<String, Object> client = resolveClient(identifier, tenant);
+        final Long clientId = ((Number) client.get("id")).longValue();
+
+        final List<Map<String, Object>> rows = jdbcTemplate.query(ACCOUNTS_SQL, new AccountRowMapper(), clientId, clientId);
+
+        final Map<String, Integer> countByType = new LinkedHashMap<>();
+        for (final Map<String, Object> row : rows) {
+            final String accountType = (String) row.get("accountType");
+            countByType.merge(accountType, 1, Integer::sum);
+        }
+
+        final Long officeId = ((Number) client.get("office_id")).longValue();
+        final Map<String, Object> branch = resolveBranch(officeId);
+        final Map<String, Object> bank = resolveBank();
+
+        final JsonObject res = new JsonObject();
+        // Which bank this response came from -- not decorative. One API key now authenticates
+        // against every tenant (see ApiClientCredentialService), so the ONLY thing that decides
+        // whose data comes back is the Fineract-Platform-TenantId header the caller sent. Echoing it
+        // (plus the bank's display name) back in the body means a caller debugging "why did I get
+        // client X's data instead of client Y's" can tell from the response alone, without having to
+        // go back and re-check what header value they actually sent.
+        res.addProperty("tenantId", tenant.getTenantIdentifier());
+        res.addProperty("tenantName", tenant.getName());
+        res.addProperty("searchedIdentifier", identifier);
+        res.addProperty("clientId", clientId);
+        res.addProperty("matchedBy", (String) client.get("matched_by"));
+        res.addProperty("clientNo", (String) client.get("account_no"));
+        res.addProperty("clientName", (String) client.get("display_name"));
+        res.addProperty("mobileNo", (String) client.get("mobile_no"));
+        res.addProperty("officeId", officeId);
+        res.addProperty("clientStatusEnum", ((Number) client.get("status_enum")).intValue());
+        res.add("branch", gson.toJsonTree(branch));
+        res.add("bank", gson.toJsonTree(bank));
+        res.addProperty("totalAccounts", rows.size());
+        res.add("accountsByType", gson.toJsonTree(countByType));
+        res.add("accounts", gson.toJsonTree(rows));
+        return gson.toJson(res);
+    }
+
+    /**
+     * An office with no {@code m_office_profile} row yet (see
+     * {@code org.apache.fineract.portfolio.orgsetup.api.BranchProfileApiResource}) is a valid, ordinary
+     * state -- every field beyond {@code officeId}/{@code officeName} just comes back null rather than
+     * this call failing or being skipped.
+     */
+    private Map<String, Object> resolveBranch(final Long officeId) {
+        final Map<String, Object> row = jdbcTemplate.queryForMap(BRANCH_SQL, officeId);
+        final Map<String, Object> branch = new LinkedHashMap<>();
+        branch.put("officeId", officeId);
+        branch.put("officeName", row.get("office_name"));
+        branch.put("branchCode", row.get("branch_code"));
+        branch.put("branchType", row.get("branch_type"));
+        branch.put("address", row.get("address"));
+        branch.put("pincode", row.get("pincode"));
+        branch.put("ifscCode", row.get("ifsc_code"));
+        branch.put("micrCode", row.get("micr_code"));
+        branch.put("contactPhone", row.get("contact_phone"));
+        branch.put("contactEmail", row.get("contact_email"));
+        return branch;
+    }
+
+    /**
+     * The bank running this tenant is a singleton row (id=1) that only gets created the first time
+     * someone opens the Bank Profile screen (see {@code InstitutionProfileApiResource#ensureRowExists}
+     * -- this endpoint never creates it itself, it only reads). A tenant where nobody has ever opened
+     * that screen yet is a valid, ordinary state, not an error -- {@code bank} just comes back {@code
+     * null} in the response rather than this call failing.
+     */
+    private Map<String, Object> resolveBank() {
+        final Map<String, Object> row;
+        try {
+            row = jdbcTemplate.queryForMap(BANK_SQL);
+        } catch (final EmptyResultDataAccessException e) {
+            return null;
+        }
+        final Map<String, Object> bank = new LinkedHashMap<>();
+        bank.put("bankName", row.get("bank_name"));
+        bank.put("legalName", row.get("legal_name"));
+        bank.put("shortName", row.get("short_name"));
+        bank.put("bankCode", row.get("bank_code"));
+        bank.put("swiftBic", row.get("swift_bic"));
+        bank.put("addressLine1", row.get("address_line1"));
+        bank.put("addressLine2", row.get("address_line2"));
+        bank.put("city", row.get("city"));
+        bank.put("district", row.get("district"));
+        bank.put("state", row.get("state"));
+        bank.put("pincode", row.get("pincode"));
+        bank.put("contactPhone", row.get("contact_phone"));
+        bank.put("contactEmail", row.get("contact_email"));
+        bank.put("customerCareNumber", row.get("customer_care_number"));
+        bank.put("website", row.get("website"));
+        return bank;
+    }
+
+    /**
+     * Resolves the path identifier as a client number first, then a mobile number -- two lookups in
+     * the worst case, one in the common case, both on unique indexed columns
+     * ({@code m_client_account_no_key}, {@code m_client_mobile_no_key} / {@code idx_client_mobile_no}),
+     * so neither costs more than the single index-scan lookup this whole endpoint is built around.
+     * Client number is tried first because it's the identifier a teller normally has on the slip in
+     * front of them; falling through to mobile number covers the third-party case where that's the
+     * only thing the caller was given. A value that happens to collide across both columns for two
+     * different clients is not handled specially -- account numbers and mobile numbers use disjoint
+     * formats in this system, so this cannot occur in practice.
+     *
+     * {@code tenant} is only for the not-found message: with one API key now valid across every bank
+     * (see {@link ApiClientCredentialService}), a lookup that finds nothing is as often "right
+     * identifier, wrong bank" (a stale or mistyped {@code Fineract-Platform-TenantId} header) as it is
+     * a genuinely unknown client -- naming the bank actually searched turns that from a guessing game
+     * into something the caller can act on immediately.
+     */
+    private Map<String, Object> resolveClient(final String identifier, final FineractPlatformTenant tenant) {
+        final List<Map<String, Object>> byAccountNo = jdbcTemplate.queryForList("""
+                SELECT id, account_no, display_name, mobile_no, office_id, status_enum
+                  FROM m_client WHERE account_no = ?
+                """, identifier);
+        if (!byAccountNo.isEmpty()) {
+            final Map<String, Object> client = new LinkedHashMap<>(byAccountNo.get(0));
+            client.put("matched_by", "CLIENT_NO");
+            return client;
+        }
+
+        final List<Map<String, Object>> byMobileNo = jdbcTemplate.queryForList("""
+                SELECT id, account_no, display_name, mobile_no, office_id, status_enum
+                  FROM m_client WHERE mobile_no = ?
+                """, identifier);
+        if (!byMobileNo.isEmpty()) {
+            final Map<String, Object> client = new LinkedHashMap<>(byMobileNo.get(0));
+            client.put("matched_by", "MOBILE_NO");
+            return client;
+        }
+
+        throw apiError(404, "No client found with client number or mobile number '" + identifier + "' in tenant '"
+                + tenant.getTenantIdentifier() + "' (" + tenant.getName() + "). If you expected a match, check the "
+                + "Fineract-Platform-TenantId header -- this identifier may belong to a different bank.");
+    }
+
+    /**
+     * Builds the error response body itself rather than throwing a bare {@code jakarta.ws.rs.*}
+     * exception: {@code NotFoundException(String)} only sets the Java exception's own message (for
+     * logs), it never puts that text on the wire -- no exception mapper in this app converts a plain
+     * NotFoundException's message into the response body, so the caller always got
+     * {@code {timestamp,status,error,path}} with nothing else, no matter how descriptive the message
+     * passed to the constructor was.
+     *
+     * One message field, not the {@code message}/{@code defaultUserMessage}/{@code errors[0]
+     * .defaultUserMessage} triple {@code ClerkClosureRequestApiResource#apiError} uses: that shape
+     * exists there to line up with Fineract's own multi-field validation errors, where {@code errors}
+     * really does carry one entry per invalid parameter. This endpoint never raises more than one
+     * error at a time, so the same sentence repeated three times said nothing extra, only made the
+     * body longer.
+     */
+    private WebApplicationException apiError(final int httpStatus, final String message) {
+        final JsonObject body = new JsonObject();
+        body.addProperty("httpStatusCode", httpStatus);
+        body.addProperty("message", message);
+        return new WebApplicationException(Response.status(httpStatus).entity(gson.toJson(body)).type(MediaType.APPLICATION_JSON).build());
+    }
+
+    private String resolveClientIp(final HttpServletRequest request) {
+        for (final String header : IP_HEADER_CANDIDATES) {
+            final String value = request.getHeader(header);
+            if (StringUtils.isNotBlank(value)) {
+                // X-Forwarded-For can carry a chain ("client, proxy1, proxy2") -- the first entry is
+                // the original caller, which is what an allowlist entry is written against.
+                return value.split(",")[0].trim();
+            }
+        }
+        return request.getRemoteAddr();
+    }
+
+    /**
+     * Maps one UNION leg row into a flat, display-ready shape -- category label and human status only.
+     * No balance figure of any kind: this is an account listing, not a balance enquiry (see the class
+     * Javadoc).
+     */
+    private static final class AccountRowMapper implements RowMapper<Map<String, Object>> {
+
+        @Override
+        public Map<String, Object> mapRow(final ResultSet rs, final int rowNum) throws SQLException {
+            final int depositType = rs.getInt("deposit_type");
+            final Integer statusEnum = JdbcSupport.getInteger(rs, "status_enum");
+
+            final Map<String, Object> row = new LinkedHashMap<>();
+            row.put("accountType", accountTypeFor(depositType));
+            row.put("accountId", rs.getLong("account_id"));
+            row.put("accountNo", rs.getString("account_no"));
+            row.put("externalId", rs.getString("external_id"));
+            row.put("productId", rs.getLong("product_id"));
+            row.put("productName", rs.getString("product_name"));
+            row.put("shortProductName", rs.getString("short_product_name"));
+            row.put("currencyCode", rs.getString("currency_code"));
+            // .toString(), not the raw LocalDate: this Gson instance has no java.time adapter
+            // registered, so it falls back to reflecting LocalDate's private fields -- which the JVM
+            // module system blocks outright (java.base does not open java.time to reflection from an
+            // unnamed module), turning every response into a 500. A plain ISO-8601 string needs no
+            // adapter and is what every other date field in this API already returns.
+            row.put("submittedDate", toIsoDateString(JdbcSupport.getLocalDate(rs, "submitted_date")));
+            row.put("activatedDate", toIsoDateString(JdbcSupport.getLocalDate(rs, "activated_date")));
+
+            final SavingsAccountStatusEnumData status = SavingsEnumerations.status(statusEnum);
+            row.put("status", status);
+            return row;
+        }
+
+        private String accountTypeFor(final int depositType) {
+            return switch (depositType) {
+                case 100 -> "Savings Account";
+                case 200 -> "Fixed Deposit";
+                case 300 -> "Recurring Deposit";
+                case 400 -> "Current Account";
+                default -> "Other";
+            };
+        }
+
+        private String toIsoDateString(final LocalDate date) {
+            return date == null ? null : date.toString();
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/api/ClientBehaviourWindowApiResource.java

@@ -0,0 +1,56 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.ToApiJsonSerializer;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.client.data.ClientBehaviourWindowData;
+import org.apache.fineract.portfolio.client.service.ClientBehaviourWindowReadPlatformService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/risk-review/behaviour-windows")
+@Component
+@Tag(name = "Client Behaviour Windows", description = "What each customer's money did over the review period, and the rating that suggests.")
+@RequiredArgsConstructor
+public class ClientBehaviourWindowApiResource {
+
+    private final PlatformSecurityContext context;
+    private final ClientBehaviourWindowReadPlatformService readPlatformService;
+    private final ToApiJsonSerializer<ClientBehaviourWindowData> toApiJsonSerializer;
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "The latest behaviour window for each customer",
+            description = "One row per customer, carrying the period's figures and the rating the policy suggests from them. Computed nightly; the screen shows what the suggestion was drawn from rather than recomputing it.")
+    public String retrieveAll() {
+        this.context.authenticatedUser();
+        final List<ClientBehaviourWindowData> windows = this.readPlatformService.retrieveLatestPerClient();
+        return this.toApiJsonSerializer.serialize(windows);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/api/ClientKycApiResource.java

@@ -160,10 +160,13 @@ public class ClientKycApiResource {
         template.put("clientTypeName", clientTypeName);
         template.put("legalFormId", legalFormId);
 
-        // Minor detection mirrors the frontend's own rule (age < 18) so the document list
-        // served here stays consistent with what the UI computes from the same date of birth.
+        // Minor detection mirrors the frontend's own rule so the document list served here stays
+        // consistent with what the UI computes from the same date of birth. Both sides read the
+        // threshold from a single named constant -- when they disagree, this endpoint wins and would
+        // silently serve an adult document list (mandatory PAN) to a minor.
         final LocalDate dateOfBirth = client.dateOfBirth();
-        final boolean isMinor = dateOfBirth != null && Period.between(dateOfBirth, LocalDate.now()).getYears() < 18;
+        final boolean isMinor = dateOfBirth != null
+                && Period.between(dateOfBirth, LocalDate.now()).getYears() < ClientApiConstants.MINOR_AGE_THRESHOLD;
         template.put("isMinor", isMinor);
 
         template.put("requiredDocuments", getRequiredDocuments(clientTypeName, legalFormId, isMinor));

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/api/ClientKycExceptionsApiResource.java

@@ -70,4 +70,23 @@ public class ClientKycExceptionsApiResource {
         }
         return this.toApiJsonSerializer.serialize(exceptions);
     }
+
+    /**
+     * Customers whose periodic re-KYC has already fallen due.
+     *
+     * <p>
+     * Sits under the exceptions path because it is the same worklist to the branch — a customer the
+     * bank has to reach — and the outreach is recorded against the same contact log.
+     */
+    @GET
+    @Path("lapsed")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Retrieve lapsed KYC records", description = "Returns clients whose periodic re-KYC due date has passed, oldest first.")
+    public String retrieveLapsedKyc() {
+        this.context.authenticatedUser();
+        final List<ClientKycData> lapsed = this.readPlatformService.retrieveLapsedKyc();
+        LOG.info("retrieveLapsedKyc: fetched {} lapsed KYC record(s) from database", lapsed.size());
+        return this.toApiJsonSerializer.serialize(lapsed);
+    }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/ClientBehaviourWindowData.java

@@ -0,0 +1,39 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.data;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+
+/**
+ * One customer's review period as the Risk Review screen shows it.
+ *
+ * <p>
+ * The figures travel with the suggestion rather than being recomputed by the screen. A recommendation an officer is
+ * asked to approve has to show what it was drawn from - months later, the same row must still explain itself - and a
+ * second calculation in the browser could disagree with the one the policy actually used.
+ */
+public record ClientBehaviourWindowData(Long clientId, String clientName, String accountNo, String officeName,
+        LocalDate windowFrom, LocalDate windowTo, Integer txnCount, Integer distinctMonths, BigDecimal creditTotal,
+        BigDecimal debitTotal, BigDecimal largestTxn, Integer cashTxnCount, BigDecimal cashTotal, Integer largeTxnCount,
+        BigDecimal declaredAnnualIncome, BigDecimal incomeRatio, Integer alertCount, Integer strCaseCount,
+        Integer riskCategoryAtReview, String suggestedDirection, Integer suggestedCategory, String suggestionReason)
+        implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/ClientKycApiConstants.java

@@ -97,6 +97,20 @@ public final class ClientKycApiConstants {
     public static final String form15ApplicableParam = "form15Applicable";
     public static final String form15TypeParam = "form15Type";
     public static final String form15FYParam = "form15FY";
+    /**
+     * Customer facts the risk re-rating policy tests against.
+     *
+     * <p>
+     * A politically exposed person is not downgraded because their activity looks ordinary - that is precisely the
+     * risk - and the same holds for a sanctions or adverse-media match. The declared figures are what "turnover out of
+     * keeping with the customer's stated income" is measured against.
+     */
+    public static final String isPepParam = "isPep";
+    public static final String sanctionsMatchParam = "sanctionsMatch";
+    public static final String adverseMediaMatchParam = "adverseMediaMatch";
+    public static final String declaredAnnualIncomeParam = "declaredAnnualIncome";
+    public static final String declaredAnnualTurnoverParam = "declaredAnnualTurnover";
+
     public static final String isExceptionParam = "isException";
     public static final String exceptionReasonParam = "exceptionReason";
     public static final String exceptionResolvedParam = "exceptionResolved";
@@ -117,7 +131,9 @@ public final class ClientKycApiConstants {
             panDeclarationTakenParam, panDeclarationMismatchFieldsParam, panDeclarationNameOnPanParam,
             panDeclarationDobOnPanParam, panDeclarationRemarksParam, panDeclarationTakenOnParam,
             aadhaarReceiptTakenParam, aadhaarEnrolmentIdParam, aadhaarEnrolmentDateParam,
-            aadhaarReceiptRemarksParam, aadhaarReceiptTakenOnParam));
+            aadhaarReceiptRemarksParam, aadhaarReceiptTakenOnParam,
+            isPepParam, sanctionsMatchParam, adverseMediaMatchParam,
+            declaredAnnualIncomeParam, declaredAnnualTurnoverParam));
 
     public static final Set<String> UPDATE_REQUEST_PARAMS = new HashSet<>(Arrays.asList(
             kycTypeParam, panNumberParam, aadhaarNumberMaskedParam, gstinNumberParam,
@@ -133,7 +149,9 @@ public final class ClientKycApiConstants {
             panDeclarationTakenParam, panDeclarationMismatchFieldsParam, panDeclarationNameOnPanParam,
             panDeclarationDobOnPanParam, panDeclarationRemarksParam, panDeclarationTakenOnParam,
             aadhaarReceiptTakenParam, aadhaarEnrolmentIdParam, aadhaarEnrolmentDateParam,
-            aadhaarReceiptRemarksParam, aadhaarReceiptTakenOnParam));
+            aadhaarReceiptRemarksParam, aadhaarReceiptTakenOnParam,
+            isPepParam, sanctionsMatchParam, adverseMediaMatchParam,
+            declaredAnnualIncomeParam, declaredAnnualTurnoverParam));
 
     /** verify command: existing flags + Aadhaar OTP fields for the verify-otp step. */
     public static final Set<String> VERIFY_REQUEST_PARAMS = new HashSet<>(Arrays.asList(

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/ClientKycData.java

@@ -122,6 +122,13 @@ public final class ClientKycData {
     private final String form15Type;
     private final String form15Fy;
 
+    // ── Risk profile ─────────────────────────────────────────────────────────
+    private final Boolean isPep;
+    private final Boolean sanctionsMatch;
+    private final Boolean adverseMediaMatch;
+    private final java.math.BigDecimal declaredAnnualIncome;
+    private final java.math.BigDecimal declaredAnnualTurnover;
+
     // ── CKYCRR ────────────────────────────────────────────────────────────────
     private final String ckycNumber;
     private final LocalDate ckycUploadedOn;

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/KycRiskRuleData.java

@@ -27,6 +27,10 @@ public final class KycRiskRuleData implements Serializable {
 
     private final Long id;
     private final String ruleName;
+    /** "KYC" (profile-driven, categorises at onboarding) or "AML" (transaction-monitoring
+     *  scenario). The client risk calculator evaluates KYC rules only - an AML rule describes
+     *  behaviour and may only fire against a posted transaction. */
+    private final String ruleKind;
     private final Integer legalFormId;
     private final Long occupationCategoryCvId;
     private final String occupationCategoryName;
@@ -61,7 +65,7 @@ public final class KycRiskRuleData implements Serializable {
     private final BigDecimal txnMinLimitAmount;
     private final BigDecimal txnMaxLimitAmount;
 
-    public KycRiskRuleData(final Long id, final String ruleName, final Integer legalFormId,
+    public KycRiskRuleData(final Long id, final String ruleName, final String ruleKind, final Integer legalFormId,
             final Long occupationCategoryCvId, final String occupationCategoryName,
             final Long occupationCvId, final String occupationName,
             final BigDecimal minMonthlyIncome, final BigDecimal maxMonthlyIncome,
@@ -75,6 +79,7 @@ public final class KycRiskRuleData implements Serializable {
             final BigDecimal txnMinLimitAmount, final BigDecimal txnMaxLimitAmount) {
         this.id = id;
         this.ruleName = ruleName;
+        this.ruleKind = ruleKind;
         this.legalFormId = legalFormId;
         this.occupationCategoryCvId = occupationCategoryCvId;
         this.occupationCategoryName = occupationCategoryName;
@@ -111,6 +116,10 @@ public final class KycRiskRuleData implements Serializable {
         return ruleName;
     }
 
+    public String getRuleKind() {
+        return ruleKind;
+    }
+
     public Integer getLegalFormId() {
         return legalFormId;
     }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/KycRiskRuleRequest.java

@@ -40,6 +40,12 @@ public class KycRiskRuleRequest {
     @Schema(description = "Rule description shown in the catalog", requiredMode = Schema.RequiredMode.REQUIRED)
     private String ruleName;
 
+    @Schema(description = "Which family the rule belongs to: KYC for a profile rule that categorises a customer at "
+            + "onboarding from occupation / income / turnover, or AML for a transaction-monitoring scenario that may "
+            + "only fire against posted transactions. Omit to have it inferred - supplying transaction settings, or "
+            + "naming no profile criteria at all, makes it AML.", example = "KYC")
+    private String ruleKind;
+
     @Schema(description = "Reason / criteria text explaining why the rule exists",
             requiredMode = Schema.RequiredMode.REQUIRED)
     private String reason;

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/jobs/applykycexpiryrestrictions/ApplyKycExpiryRestrictionsConfig.java

@@ -0,0 +1,52 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.jobs.applykycexpiryrestrictions;
+
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class ApplyKycExpiryRestrictionsConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+
+    @Bean
+    protected Step applyKycExpiryRestrictionsStep(ApplyKycExpiryRestrictionsTasklet applyKycExpiryRestrictionsTasklet) {
+        return new StepBuilder(JobName.APPLY_KYC_EXPIRY_RESTRICTIONS.name(), jobRepository)
+                .tasklet(applyKycExpiryRestrictionsTasklet, transactionManager).build();
+    }
+
+    @Bean
+    public Job applyKycExpiryRestrictionsJob(ApplyKycExpiryRestrictionsTasklet applyKycExpiryRestrictionsTasklet) {
+        return new JobBuilder(JobName.APPLY_KYC_EXPIRY_RESTRICTIONS.name(), jobRepository)
+                .start(applyKycExpiryRestrictionsStep(applyKycExpiryRestrictionsTasklet)).incrementer(new RunIdIncrementer()).build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/jobs/applykycexpiryrestrictions/ApplyKycExpiryRestrictionsTasklet.java

@@ -0,0 +1,46 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.jobs.applykycexpiryrestrictions;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.portfolio.client.service.KycExpiryRestrictionService;
+import org.springframework.batch.core.StepContribution;
+import org.springframework.batch.core.scope.context.ChunkContext;
+import org.springframework.batch.core.step.tasklet.Tasklet;
+import org.springframework.batch.repeat.RepeatStatus;
+import org.springframework.stereotype.Component;
+
+/**
+ * Nightly pass over customers whose periodic re-KYC has lapsed, applying the restriction each one
+ * has reached and releasing those whose KYC has since been renewed.
+ */
+@Slf4j
+@RequiredArgsConstructor
+@Component
+public class ApplyKycExpiryRestrictionsTasklet implements Tasklet {
+
+    private final KycExpiryRestrictionService kycExpiryRestrictionService;
+
+    @Override
+    public RepeatStatus execute(StepContribution contribution, ChunkContext chunkContext) throws Exception {
+        kycExpiryRestrictionService.applyRestrictions();
+        return RepeatStatus.FINISHED;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/jobs/clientbehaviourwindow/ClientBehaviourWindowJobConfig.java

@@ -0,0 +1,60 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.jobs.clientbehaviourwindow;
+
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.apache.fineract.portfolio.client.service.ClientBehaviourWindowService;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class ClientBehaviourWindowJobConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+    @Autowired
+    private ClientBehaviourWindowService clientBehaviourWindowService;
+
+    @Bean
+    public ClientBehaviourWindowTasklet clientBehaviourWindowTasklet() {
+        return new ClientBehaviourWindowTasklet(clientBehaviourWindowService);
+    }
+
+    @Bean
+    protected Step clientBehaviourWindowStep() {
+        return new StepBuilder(JobName.CLIENT_BEHAVIOUR_WINDOW.name(), jobRepository)
+                .tasklet(clientBehaviourWindowTasklet(), transactionManager).build();
+    }
+
+    @Bean
+    public Job clientBehaviourWindowJob() {
+        return new JobBuilder(JobName.CLIENT_BEHAVIOUR_WINDOW.name(), jobRepository).start(clientBehaviourWindowStep())
+                .incrementer(new RunIdIncrementer()).build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/jobs/clientbehaviourwindow/ClientBehaviourWindowTasklet.java

@@ -0,0 +1,45 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.jobs.clientbehaviourwindow;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.portfolio.client.service.ClientBehaviourWindowService;
+import org.springframework.batch.core.StepContribution;
+import org.springframework.batch.core.scope.context.ChunkContext;
+import org.springframework.batch.core.step.tasklet.Tasklet;
+import org.springframework.batch.repeat.RepeatStatus;
+
+/**
+ * Recomputes every customer's behaviour window and the rating each one suggests.
+ *
+ * <p>
+ * The job only ever writes a suggestion. Moving a rating remains a decision an officer makes and a checker approves,
+ * which is what a re-rating is: a judgement about a customer, recorded by someone who is accountable for it.
+ */
+@RequiredArgsConstructor
+public class ClientBehaviourWindowTasklet implements Tasklet {
+
+    private final ClientBehaviourWindowService service;
+
+    @Override
+    public RepeatStatus execute(final StepContribution contribution, final ChunkContext chunkContext) {
+        service.computeForAllClients();
+        return RepeatStatus.FINISHED;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientBehaviourWindowReadPlatformService.java

@@ -0,0 +1,80 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.service;
+
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.portfolio.client.data.ClientBehaviourWindowData;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Serves the most recent behaviour window for each customer, with the customer resolved.
+ *
+ * <p>
+ * Only the latest window per customer: the table keeps each night's computation, and a review screen showing a
+ * customer once per night would be unreadable within a week.
+ */
+@Service
+@RequiredArgsConstructor
+@Transactional(readOnly = true)
+public class ClientBehaviourWindowReadPlatformService {
+
+    private static final String SQL = """
+            SELECT w.client_id, c.display_name AS client_name, c.account_no, o.name AS office_name,
+                   w.window_from, w.window_to, w.txn_count, w.distinct_months, w.credit_total, w.debit_total, w.largest_txn,
+                   w.cash_txn_count, w.cash_total, w.large_txn_count, w.declared_annual_income, w.income_ratio,
+                   w.alert_count, w.str_case_count, w.risk_category_at_review,
+                   w.suggested_direction, w.suggested_category, w.suggestion_reason
+              FROM m_client_behaviour_window w
+              JOIN m_client c ON c.id = w.client_id
+              LEFT JOIN m_office o ON o.id = c.office_id
+              LEFT JOIN m_client_kyc k ON k.client_id = c.id AND COALESCE(k.is_deleted, false) = false
+              -- The latest window per customer. DISTINCT ON keeps the first row of each client group, and the ORDER BY
+              -- is what makes that the newest one.
+             WHERE w.id IN (SELECT DISTINCT ON (client_id) id FROM m_client_behaviour_window
+                             ORDER BY client_id, window_to DESC, computed_on DESC, id DESC)
+               -- A window describes the rating the customer held when the job ran. Once an officer moves that rating
+               -- the window is describing a customer who no longer exists, and serving it would have the screen go on
+               -- asking for a change that has already been applied and approved. Suppressed until tonight's run
+               -- recomputes it against the rating now on file.
+               AND (w.risk_category_at_review IS NULL OR k.risk_category IS NULL
+                    OR w.risk_category_at_review = k.risk_category)
+             ORDER BY CASE w.suggested_direction WHEN 'UP' THEN 0 WHEN 'DOWN' THEN 1 ELSE 2 END,
+                      c.display_name
+            """;
+
+    private final JdbcTemplate jdbcTemplate;
+
+    public List<ClientBehaviourWindowData> retrieveLatestPerClient() {
+        return jdbcTemplate.query(SQL, (rs, rowNum) -> new ClientBehaviourWindowData(rs.getLong("client_id"),
+                rs.getString("client_name"), rs.getString("account_no"), rs.getString("office_name"),
+                rs.getDate("window_from") == null ? null : rs.getDate("window_from").toLocalDate(),
+                rs.getDate("window_to") == null ? null : rs.getDate("window_to").toLocalDate(),
+                (Integer) rs.getObject("txn_count"), (Integer) rs.getObject("distinct_months"), rs.getBigDecimal("credit_total"),
+                rs.getBigDecimal("debit_total"),
+                rs.getBigDecimal("largest_txn"), (Integer) rs.getObject("cash_txn_count"), rs.getBigDecimal("cash_total"),
+                (Integer) rs.getObject("large_txn_count"), rs.getBigDecimal("declared_annual_income"),
+                rs.getBigDecimal("income_ratio"), (Integer) rs.getObject("alert_count"),
+                (Integer) rs.getObject("str_case_count"), (Integer) rs.getObject("risk_category_at_review"),
+                rs.getString("suggested_direction"), (Integer) rs.getObject("suggested_category"),
+                rs.getString("suggestion_reason")));
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientBehaviourWindowService.java

@@ -0,0 +1,247 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.service;
+
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.portfolio.client.domain.ClientBehaviourWindow;
+import org.apache.fineract.portfolio.client.domain.ClientBehaviourWindowRepository;
+import org.apache.fineract.portfolio.client.service.RiskMovementPolicyService.BehaviourFacts;
+import org.apache.fineract.portfolio.client.service.RiskMovementPolicyService.Recommendation;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Computes what each customer's money did over a period, and asks the policy what that means for their rating.
+ *
+ * <p>
+ * Run nightly. The figures are aggregated in the database rather than by loading each customer's transactions into
+ * memory: a book of any size would otherwise read every transaction row it has ever written, once per customer, every
+ * night.
+ *
+ * <p>
+ * Two windows are computed per customer, not one. An upgrade asks what the customer is doing now and reads a short
+ * window; a downgrade asks whether a year of conduct supports removing a rating. Computing only the longer window
+ * would delay every upgrade by months, and only the shorter would lower ratings on a quiet fortnight.
+ */
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class ClientBehaviourWindowService {
+
+    /**
+     * One customer's aggregated activity for one window.
+     *
+     * <p>
+     * Every count and total is computed in SQL; nothing here re-reads transactions.
+     */
+    private record Aggregate(Long clientId, Integer currentCategory, int txnCount, int distinctMonths, BigDecimal creditTotal,
+            BigDecimal debitTotal, BigDecimal largestTxn, int cashTxnCount, BigDecimal cashTotal, int largeTxnCount,
+            int ctrTxnCount, int mediumAlertCount, int highAlertCount, int openStrCount, int strInBlockWindow, boolean pep,
+            boolean sanctionsMatch, boolean adverseMedia, boolean graveRuleFired, boolean kycOverdue,
+            Integer daysInCurrentCategory, BigDecimal declaredIncome, BigDecimal declaredTurnover) {}
+
+    /**
+     * Everything the policy tests, for every active customer, in one pass.
+     *
+     * <p>
+     * Each subquery is scoped to the same window so the figures describe one period. Alerts are counted by their worst
+     * matched severity rather than by the rule the alert was raised under, because a statutory CTR outranks a
+     * behavioural rule when the governing rule is picked - counting the governing rule would lose the high-severity
+     * finding underneath it.
+     */
+    private static final String AGGREGATE_SQL = """
+            SELECT c.id AS client_id,
+                   k.risk_category AS current_category,
+                   COALESCE(t.txn_count, 0) AS txn_count,
+                   COALESCE(t.distinct_months, 0) AS distinct_months,
+                   COALESCE(t.credit_total, 0) AS credit_total,
+                   COALESCE(t.debit_total, 0) AS debit_total,
+                   COALESCE(t.largest_txn, 0) AS largest_txn,
+                   COALESCE(t.cash_txn_count, 0) AS cash_txn_count,
+                   COALESCE(t.cash_total, 0) AS cash_total,
+                   COALESCE(t.large_txn_count, 0) AS large_txn_count,
+                   COALESCE(t.ctr_txn_count, 0) AS ctr_txn_count,
+                   COALESCE(a.medium_alerts, 0) AS medium_alerts,
+                   COALESCE(a.high_alerts, 0) AS high_alerts,
+                   COALESCE(a.grave_rule, false) AS grave_rule,
+                   COALESCE(s.open_str, 0) AS open_str,
+                   COALESCE(s.str_in_block_window, 0) AS str_in_block_window,
+                   COALESCE(k.is_pep, false) AS pep,
+                   COALESCE(k.sanctions_match, false) AS sanctions_match,
+                   COALESCE(k.adverse_media_match, false) AS adverse_media,
+                   CASE WHEN k.expiry_date IS NOT NULL AND k.expiry_date < ? THEN true ELSE false END AS kyc_overdue,
+                   h.days_in_category,
+                   k.declared_annual_income,
+                   k.declared_annual_turnover
+              FROM m_client c
+              LEFT JOIN m_client_kyc k ON k.client_id = c.id AND COALESCE(k.is_deleted, false) = false
+              -- Savings activity in the window, by client.
+              LEFT JOIN (
+                   SELECT sa.client_id,
+                          count(*) AS txn_count,
+                          count(DISTINCT to_char(tx.transaction_date, 'YYYY-MM')) AS distinct_months,
+                          sum(CASE WHEN tx.transaction_type_enum = 1 THEN tx.amount ELSE 0 END) AS credit_total,
+                          sum(CASE WHEN tx.transaction_type_enum = 2 THEN tx.amount ELSE 0 END) AS debit_total,
+                          max(tx.amount) AS largest_txn,
+                          count(*) FILTER (WHERE pt.is_cash_payment) AS cash_txn_count,
+                          COALESCE(sum(tx.amount) FILTER (WHERE pt.is_cash_payment), 0) AS cash_total,
+                          count(*) FILTER (WHERE tx.amount >= ?) AS large_txn_count,
+                          count(*) FILTER (WHERE pt.is_cash_payment AND tx.amount >= ?) AS ctr_txn_count
+                     FROM m_savings_account_transaction tx
+                     JOIN m_savings_account sa ON sa.id = tx.savings_account_id
+                     LEFT JOIN m_payment_detail pd ON pd.id = tx.payment_detail_id
+                     LEFT JOIN m_payment_type pt ON pt.id = pd.payment_type_id
+                    WHERE tx.is_reversed = false
+                      AND tx.transaction_type_enum IN (1, 2)
+                      AND tx.transaction_date BETWEEN ? AND ?
+                    GROUP BY sa.client_id
+              ) t ON t.client_id = c.id
+              -- Alerts in the window, graded by the worst rule each matched.
+              LEFT JOIN (
+                   SELECT al.client_id,
+                          count(*) FILTER (WHERE COALESCE(al.highest_severity, 0) >= 2) AS medium_alerts,
+                          count(*) FILTER (WHERE COALESCE(al.highest_severity, 0) >= 3) AS high_alerts,
+                          bool_or(ar.rule_code IS NOT NULL) AS grave_rule
+                     FROM m_aml_alert al
+                     LEFT JOIN m_aml_alert_rule ar
+                            ON ar.alert_id = al.id
+                           AND (ar.rule_code LIKE 'STRUCTUR%' OR ar.rule_code LIKE 'PEP%'
+                                OR ar.rule_code LIKE 'SANCTION%' OR ar.rule_code LIKE 'ADVERSE_MEDIA%'
+                                OR ar.rule_code LIKE 'HIGH_RISK_COUNTRY%' OR ar.rule_code LIKE 'WILFUL_DEFAULTER%')
+                    WHERE al.raised_on >= ? AND al.raised_on < ?
+                    GROUP BY al.client_id
+              ) a ON a.client_id = c.id
+              -- STR cases: open ones hold a rating at High; recent concluded ones block a downgrade.
+              LEFT JOIN (
+                   SELECT sc.client_id,
+                          count(*) FILTER (WHERE sc.status = 'OPEN') AS open_str,
+                          count(*) FILTER (WHERE sc.created_on_utc >= ?) AS str_in_block_window
+                     FROM m_aml_str_case sc
+                    GROUP BY sc.client_id
+              ) s ON s.client_id = c.id
+              -- How long the customer has held the rating they are on, from the last recorded change.
+              LEFT JOIN (
+                   SELECT client_id, (? - max(changed_on)::date) AS days_in_category
+                     FROM m_client_risk_category_history
+                    GROUP BY client_id
+              ) h ON h.client_id = c.id
+             WHERE c.status_enum = 300
+            """;
+
+    private final JdbcTemplate jdbcTemplate;
+    private final ClientBehaviourWindowRepository windowRepository;
+    private final RiskMovementPolicyService policyService;
+
+    /** ₹10,00,000 - the CTR line, and the figure "large transaction" means here. */
+    private static final BigDecimal CTR_THRESHOLD = new BigDecimal("1000000");
+
+    /**
+     * Computes tonight's windows for every active customer.
+     *
+     * <p>
+     * The upgrade window is written for every customer; the downgrade window only for those rated Medium or High,
+     * since there is nothing below Low to move to. The suggestion is taken from whichever window the policy acted on,
+     * so the figures shown beside a recommendation are the ones it was drawn from.
+     */
+    @Transactional
+    public int computeForAllClients() {
+        final LocalDate today = DateUtils.getBusinessLocalDate();
+        windowRepository.deleteByWindowTo(today);
+
+        final int upgradeDays = policyService.windowDaysFor("UPGRADE_WINDOW_DAYS", 90);
+        final int highToMediumDays = policyService.windowDaysFor("HIGH_TO_MEDIUM_WINDOW_DAYS", 365);
+        final int mediumToLowDays = policyService.windowDaysFor("MEDIUM_TO_LOW_WINDOW_DAYS", 270);
+        final int strBlockMonths = policyService.windowDaysFor("STR_BLOCK_MONTHS", 24);
+
+        final List<Aggregate> shortWindow = aggregate(today.minusDays(upgradeDays), today, strBlockMonths);
+
+        int written = 0;
+        for (final Aggregate shortAgg : shortWindow) {
+            final Integer category = shortAgg.currentCategory();
+            // A downgrade is judged over the window that band requires; Low has nothing below it.
+            final int longDays = category != null && category == RiskMovementPolicyService.HIGH ? highToMediumDays : mediumToLowDays;
+            final Aggregate longAgg = category != null && category > RiskMovementPolicyService.LOW
+                    ? one(today.minusDays(longDays), today, strBlockMonths, shortAgg.clientId())
+                    : null;
+
+            final Recommendation shortResult = policyService.evaluate(factsOf(shortAgg));
+            // The short window decides upgrades and the standing facts; anything else is a question for the long one.
+            final boolean actedOnShort = RiskMovementPolicyService.UP.equals(shortResult.direction()) || longAgg == null;
+            final Aggregate acted = actedOnShort ? shortAgg : longAgg;
+            final Recommendation result = actedOnShort ? shortResult : policyService.evaluate(factsOf(longAgg));
+
+            final LocalDate from = actedOnShort ? today.minusDays(upgradeDays) : today.minusDays(longDays);
+            final ClientBehaviourWindow window = ClientBehaviourWindow.of(acted.clientId(), from, today);
+            window.recordActivity(acted.txnCount(), acted.creditTotal(), acted.debitTotal(), acted.largestTxn(),
+                    acted.cashTxnCount(), acted.cashTotal(), acted.largeTxnCount());
+            window.recordDistinctMonths(acted.distinctMonths());
+            window.recordMonitoring(acted.mediumAlertCount(), acted.openStrCount(), acted.currentCategory());
+            window.recordDeclared(acted.declaredIncome(), acted.declaredTurnover(),
+                    acted.creditTotal() == null ? null : acted.creditTotal().add(acted.debitTotal()));
+            window.recordSuggestion(result.direction(), result.suggestedCategory(), result.reason());
+            windowRepository.save(window);
+            written++;
+        }
+        log.info("Client behaviour windows computed for {} clients as at {}", written, today);
+        return written;
+    }
+
+    private BehaviourFacts factsOf(final Aggregate a) {
+        final BigDecimal periodTotal = a.creditTotal().add(a.debitTotal());
+        return new BehaviourFacts(a.currentCategory(), a.txnCount(), a.distinctMonths(), a.cashTotal(), periodTotal,
+                a.largestTxn(), a.ctrTxnCount(), a.mediumAlertCount(), a.highAlertCount(), a.openStrCount(),
+                a.strInBlockWindow(), a.pep(), a.sanctionsMatch(), a.adverseMedia(), a.graveRuleFired(), a.kycOverdue(),
+                a.daysInCurrentCategory());
+    }
+
+    private List<Aggregate> aggregate(final LocalDate from, final LocalDate to, final int strBlockMonths) {
+        return query(AGGREGATE_SQL, from, to, strBlockMonths, null);
+    }
+
+    private Aggregate one(final LocalDate from, final LocalDate to, final int strBlockMonths, final Long clientId) {
+        final List<Aggregate> rows = query(AGGREGATE_SQL + " AND c.id = ? ", from, to, strBlockMonths, clientId);
+        return rows.isEmpty() ? null : rows.get(0);
+    }
+
+    private List<Aggregate> query(final String sql, final LocalDate from, final LocalDate to, final int strBlockMonths,
+            final Long clientId) {
+        final List<Object> args = new ArrayList<>(List.of(to, CTR_THRESHOLD, CTR_THRESHOLD, from, to, from.atStartOfDay(),
+                to.plusDays(1).atStartOfDay(), to.minusMonths(strBlockMonths).atStartOfDay(), to));
+        if (clientId != null) {
+            args.add(clientId);
+        }
+        return jdbcTemplate.query(sql, (rs, rowNum) -> new Aggregate(rs.getLong("client_id"),
+                rs.getObject("current_category") == null ? null : rs.getInt("current_category"), rs.getInt("txn_count"),
+                rs.getInt("distinct_months"), rs.getBigDecimal("credit_total"), rs.getBigDecimal("debit_total"),
+                rs.getBigDecimal("largest_txn"), rs.getInt("cash_txn_count"), rs.getBigDecimal("cash_total"),
+                rs.getInt("large_txn_count"), rs.getInt("ctr_txn_count"), rs.getInt("medium_alerts"), rs.getInt("high_alerts"),
+                rs.getInt("open_str"), rs.getInt("str_in_block_window"), rs.getBoolean("pep"), rs.getBoolean("sanctions_match"),
+                rs.getBoolean("adverse_media"), rs.getBoolean("grave_rule"), rs.getBoolean("kyc_overdue"),
+                rs.getObject("days_in_category") == null ? null : rs.getInt("days_in_category"),
+                rs.getBigDecimal("declared_annual_income"), rs.getBigDecimal("declared_annual_turnover")),
+                args.toArray());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientKycReadPlatformService.java

@@ -35,4 +35,14 @@ public interface ClientKycReadPlatformService {
     java.util.List<ClientKycData> retrieveActiveKycExceptions();
 
     java.util.List<ClientKycData> retrieveResolvedKycExceptions();
+
+    /**
+     * KYC records whose periodic re-KYC due date has already passed, oldest first.
+     *
+     * <p>
+     * These are the customers the branch has to chase and, once the grace period runs out, the
+     * accounts the restriction ladder acts on. A record whose renewal is still ahead is not
+     * included: nothing is owed on it yet.
+     */
+    java.util.List<ClientKycData> retrieveLapsedKyc();
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientKycReadPlatformServiceImpl.java

@@ -25,6 +25,7 @@ import org.apache.fineract.portfolio.client.data.ClientKycData;
 import org.apache.fineract.portfolio.client.domain.ClientKyc;
 import org.apache.fineract.portfolio.client.domain.ClientKycRepository;
 import org.apache.fineract.portfolio.client.domain.ClientKycRepositoryWrapper;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 import org.apache.fineract.portfolio.client.domain.ClientKycStatus;
 import org.apache.fineract.portfolio.client.domain.ClientKycType;
 import org.apache.fineract.portfolio.client.domain.KycRiskCategory;
@@ -131,6 +132,11 @@ public class ClientKycReadPlatformServiceImpl implements ClientKycReadPlatformSe
                 .form15Applicable(kyc.getForm15Applicable())
                 .form15Type(kyc.getForm15Type())
                 .form15Fy(kyc.getForm15Fy())
+                .isPep(kyc.isPep())
+                .sanctionsMatch(kyc.isSanctionsMatch())
+                .adverseMediaMatch(kyc.isAdverseMediaMatch())
+                .declaredAnnualIncome(kyc.getDeclaredAnnualIncome())
+                .declaredAnnualTurnover(kyc.getDeclaredAnnualTurnover())
                 .ckycNumber(kyc.getCkycNumber())
                 .ckycUploadedOn(kyc.getCkycUploadedOn())
                 .ckycBatchId(kyc.getCkycBatchId())
@@ -159,4 +165,12 @@ public class ClientKycReadPlatformServiceImpl implements ClientKycReadPlatformSe
                 .map(this::toData)
                 .collect(java.util.stream.Collectors.toList());
     }
+
+    @Override
+    public java.util.List<ClientKycData> retrieveLapsedKyc() {
+        return this.kycRepository
+                .findLapsedAsOn(DateUtils.getBusinessLocalDate(), ClientKycStatus.REJECTED.getValue()).stream()
+                .map(this::toData)
+                .collect(java.util.stream.Collectors.toList());
+    }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientKycWritePlatformServiceJpaRepositoryImpl.java

@@ -52,6 +52,8 @@ import org.apache.fineract.portfolio.client.exception.ClientKycInvalidStateTrans
 import org.apache.fineract.portfolio.client.kyc.KycVerificationResult;
 import org.apache.fineract.portfolio.client.kyc.KycVerificationService;
 import org.apache.fineract.portfolio.client.serialization.ClientKycCommandFromApiJsonDeserializer;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccount;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccountRepository;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.dao.DataIntegrityViolationException;
@@ -73,6 +75,7 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
     private final KycVerificationService kycVerificationService;
     private final FromJsonHelper fromApiJsonHelper;
     private final org.apache.fineract.portfolio.client.ckyc.CkycSftpUploadService ckycSftpUploadService;
+    private final SavingsAccountRepository savingsAccountRepository;
     private final org.apache.fineract.infrastructure.documentmanagement.service.DocumentWritePlatformService documentWritePlatformService;
 
     /** Hard cap on uploaded CKYC ZIP size to keep the byte[] copy bounded (50 MB). */
@@ -414,8 +417,13 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
                 getJsonString(panData, "aadhaar_seeding_status"),
                 getJsonString(panData, "category"),
                 getJsonString(panData, "status"));
-        kyc.tryAutoVerify();
+        final boolean fullyVerified = kyc.tryAutoVerify();
         kycRepositoryWrapper.saveAndFlush(kyc);
+        // Both checks now done, so this is a completed re-KYC and the dormancy it clears is the
+        // same one the explicit command clears.
+        if (fullyVerified) {
+            reviveDormantAccounts(clientId);
+        }
         LOG.info("verifyPan: SUCCESS for clientId={}, kycId={}, kycStatus={}", clientId, kycId, kyc.getKycStatusValue());
 
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
@@ -458,8 +466,13 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         }
 
         kyc.markAadhaarVerified();
-        kyc.tryAutoVerify();
+        final boolean fullyVerified = kyc.tryAutoVerify();
         kycRepositoryWrapper.saveAndFlush(kyc);
+        // Both checks now done, so this is a completed re-KYC and the dormancy it clears is the
+        // same one the explicit command clears.
+        if (fullyVerified) {
+            reviveDormantAccounts(clientId);
+        }
 
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
         changes.put("aadhaarVerified", true);
@@ -500,8 +513,13 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         }
 
         kyc.markGstinVerified();
-        kyc.tryAutoVerify();
+        final boolean fullyVerified = kyc.tryAutoVerify();
         kycRepositoryWrapper.saveAndFlush(kyc);
+        // Both checks now done, so this is a completed re-KYC and the dormancy it clears is the
+        // same one the explicit command clears.
+        if (fullyVerified) {
+            reviveDormantAccounts(clientId);
+        }
 
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
         changes.put("gstinVerified", true);
@@ -563,8 +581,13 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         }
 
         kyc.markCinVerified();
-        kyc.tryAutoVerify();
+        final boolean fullyVerified = kyc.tryAutoVerify();
         kycRepositoryWrapper.saveAndFlush(kyc);
+        // Both checks now done, so this is a completed re-KYC and the dormancy it clears is the
+        // same one the explicit command clears.
+        if (fullyVerified) {
+            reviveDormantAccounts(clientId);
+        }
 
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
         changes.put("cinVerified", true);
@@ -633,8 +656,13 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         final boolean companyNameMatched = matchedCompany != null;
 
         kyc.markDinVerified(dinNumber, rawMcaResponse);
-        kyc.tryAutoVerify();
+        final boolean fullyVerified = kyc.tryAutoVerify();
         kycRepositoryWrapper.saveAndFlush(kyc);
+        // Both checks now done, so this is a completed re-KYC and the dormancy it clears is the
+        // same one the explicit command clears.
+        if (fullyVerified) {
+            reviveDormantAccounts(clientId);
+        }
 
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
         changes.put("dinNumber", dinNumber);
@@ -817,11 +845,27 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         kyc.markVerified(kyc.getCkycNumber());
         kycRepositoryWrapper.saveAndFlush(kyc);
 
+        // A completed re-KYC is what revives the customer's dormant accounts.
+        //
+        // RBI's Master Direction allows a dormant account to be operated again only once the
+        // customer's identity has been established afresh, and this command is that establishment.
+        // Withdrawals are refused while an account is dormant and no transaction lifts it, so
+        // without this the account would stay frozen with no way out.
+        //
+        // Done here rather than in the nightly expiry sweep on purpose: that sweep visits every
+        // customer whose KYC is merely current, so reviving there would reopen a dormant account on
+        // the next run without anyone having verified anything.
+        final int revived = reviveDormantAccounts(clientId);
+
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
         changes.put("verifiedOn", kyc.getVerifiedOn());
         changes.put("expiryDate", kyc.getExpiryDate());
         changes.put("kycStatus", kyc.getKycStatusValue());
         changes.put("kycStatusCode", "kyc.status.verified");
+        if (revived > 0) {
+            changes.put("dormantAccountsRevived", revived);
+            LOG.info("Client {} completed re-KYC — {} dormant savings account(s) revived", clientId, revived);
+        }
         return buildResult(command, client, clientId, kycId, changes);
     }
 
@@ -1040,6 +1084,39 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
 
     // ── helpers ───────────────────────────────────────────────────────────────
 
+    /**
+     * Clears the dormancy flag from this client's savings accounts, on the strength of a completed
+     * re-KYC.
+     *
+     * <p>
+     * RBI's Master Direction allows a dormant account to be operated again only once the customer's
+     * identity has been established afresh, so this is the one thing that lifts it — no transaction
+     * does, and a withdrawal is refused while the flag stands. Called from every path that
+     * completes a verification, not only the explicit complete-rekyc command: an officer who
+     * re-verifies PAN and Aadhaar at the counter has done the same verification and must not have
+     * to know about a second button.
+     *
+     * <p>
+     * Deliberately not called from the nightly expiry sweep, which visits every customer whose KYC
+     * is merely current — reviving there would reopen a dormant account on the next run without
+     * anyone having verified anything.
+     *
+     * @return how many accounts were revived
+     */
+    private int reviveDormantAccounts(final Long clientId) {
+        int revived = 0;
+        for (final SavingsAccount account : savingsAccountRepository.findSavingAccountByClientId(clientId)) {
+            if (account.reviveOnReKyc()) {
+                savingsAccountRepository.save(account);
+                revived++;
+            }
+        }
+        if (revived > 0) {
+            LOG.info("Client {} completed re-KYC — {} dormant savings account(s) revived", clientId, revived);
+        }
+        return revived;
+    }
+
     private CommandProcessingResult buildResult(final JsonCommand command, final Client client,
             final Long clientId, final Long kycId, final Map<String, Object> changes) {
         return new CommandProcessingResultBuilder()

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/KycExpiryRestrictionService.java

@@ -0,0 +1,49 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.service;
+
+/**
+ * Applies and lifts the account restrictions that follow a lapsed periodic re-KYC.
+ */
+public interface KycExpiryRestrictionService {
+
+    /**
+     * Walks every lapsed KYC, applies the stage each one has reached, and releases customers whose
+     * KYC is current again.
+     *
+     * @return what the run did, for the job log
+     */
+    KycExpiryRunSummary applyRestrictions();
+
+    /**
+     * What one run of the ladder did.
+     *
+     * @param lapsed
+     *            KYC records past their due date
+     * @param inGrace
+     *            of those, the ones still inside the grace window with nothing restricted
+     * @param debitBlocked
+     *            customers whose debits are stopped
+     * @param fullyBlocked
+     *            customers whose accounts are inoperative
+     * @param released
+     *            accounts freed because the KYC was renewed
+     */
+    record KycExpiryRunSummary(int lapsed, int inGrace, int debitBlocked, int fullyBlocked, int released) {}
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/KycExpiryRestrictionServiceImpl.java

@@ -0,0 +1,134 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.service;
+
+import java.time.LocalDate;
+import java.time.temporal.ChronoUnit;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.portfolio.client.domain.ClientKyc;
+import org.apache.fineract.portfolio.client.domain.ClientKycRepository;
+import org.apache.fineract.portfolio.client.domain.ClientKycStatus;
+import org.apache.fineract.portfolio.client.domain.KycExpiryStage;
+import org.apache.fineract.portfolio.client.service.KycExpiryRestrictionService.KycExpiryRunSummary;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccount;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccountRepository;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Applies the restriction ladder that follows a lapsed periodic re-KYC, and lifts it once the KYC
+ * is renewed.
+ *
+ * <p>
+ * The ladder is described on {@link KycExpiryStage}. In short: nothing happens for the grace period,
+ * then debits stop, then the account goes inoperative. Closure is never reached automatically.
+ *
+ * <p>
+ * Restrictions are derived from the expiry date on every run rather than remembered, so a KYC that
+ * is renewed simply stops being lapsed and its accounts are released on the next pass. That also
+ * makes the job safe to re-run: applying a stage that is already applied changes nothing.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class KycExpiryRestrictionServiceImpl implements KycExpiryRestrictionService {
+
+    private final ClientKycRepository clientKycRepository;
+    private final SavingsAccountRepository savingsAccountRepository;
+
+    @Override
+    @Transactional
+    public KycExpiryRunSummary applyRestrictions() {
+        final LocalDate today = DateUtils.getBusinessLocalDate();
+        final List<ClientKyc> lapsed = clientKycRepository.findLapsedAsOn(today, ClientKycStatus.REJECTED.getValue());
+
+        int debitBlocked = 0;
+        int fullyBlocked = 0;
+        int inGrace = 0;
+
+        for (final ClientKyc kyc : lapsed) {
+            final long daysOverdue = ChronoUnit.DAYS.between(kyc.getExpiryDate(), today);
+            final KycExpiryStage stage = KycExpiryStage.fromDaysOverdue(daysOverdue);
+            if (stage == null || stage.isGrace()) {
+                // Inside the grace window nothing is restricted; the customer is only being chased.
+                inGrace++;
+                continue;
+            }
+
+            final Long clientId = kyc.getClient().getId();
+            final List<SavingsAccount> accounts = savingsAccountRepository.findSavingAccountByClientId(clientId);
+            boolean changedAny = false;
+
+            for (final SavingsAccount account : accounts) {
+                final boolean changed = stage.isInoperative() ? account.applyKycExpiryFullBlock() : account.applyKycExpiryDebitBlock();
+                if (changed) {
+                    savingsAccountRepository.save(account);
+                    changedAny = true;
+                }
+            }
+
+            if (stage.isInoperative()) {
+                fullyBlocked++;
+            } else {
+                debitBlocked++;
+            }
+
+            if (changedAny) {
+                log.info("Client {} re-KYC lapsed {} days ago — {} applied to their savings accounts", clientId, daysOverdue, stage);
+            }
+        }
+
+        final int released = releaseRenewed(today);
+        final KycExpiryRunSummary summary = new KycExpiryRunSummary(lapsed.size(), inGrace, debitBlocked, fullyBlocked, released);
+        log.info("KYC expiry restrictions applied: {}", summary);
+        return summary;
+    }
+
+    /**
+     * Lifts restrictions from customers whose KYC is current again.
+     *
+     * <p>
+     * Renewing a KYC pushes its expiry date into the future, so a renewed customer simply drops out
+     * of the lapsed set. Nothing records that this job was the one that blocked the account, so only
+     * the two states the ladder itself sets are cleared — see
+     * {@link SavingsAccount#releaseKycExpiryBlock()} — and a manual block is left untouched.
+     */
+    private int releaseRenewed(final LocalDate today) {
+        final List<ClientKyc> current = clientKycRepository.findAllByStatus(ClientKycStatus.VERIFIED.getValue());
+        int released = 0;
+
+        for (final ClientKyc kyc : current) {
+            if (kyc.getExpiryDate() == null || !kyc.getExpiryDate().isAfter(today)) {
+                continue;
+            }
+            for (final SavingsAccount account : savingsAccountRepository.findSavingAccountByClientId(kyc.getClient().getId())) {
+                if (account.releaseKycExpiryBlock()) {
+                    savingsAccountRepository.save(account);
+                    released++;
+                    log.info("Client {} re-KYC renewed to {} — restrictions lifted on savings account {}", kyc.getClient().getId(),
+                            kyc.getExpiryDate(), account.getId());
+                }
+            }
+        }
+        return released;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/KycRestrictionGuard.java

@@ -0,0 +1,201 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.service;
+
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.portfolio.client.domain.KycExpiryStage;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+
+/**
+ * What a customer with a lapsed periodic re-KYC may still do with their savings account.
+ *
+ * <p>
+ * One service because the answer has to be the same at every counter the money can leave by — the
+ * clerk's withdrawal request, the cashier's deposit, an account-to-account transfer, a transfer to
+ * or from a GL. Those are separate resources that each validate their own input, and a rule copied
+ * into four of them is a rule that will disagree with itself the first time one is edited.
+ *
+ * <h3>The ladder</h3>
+ *
+ * <table>
+ * <tr><th>Days overdue</th><th>Money out (withdrawal, transfer out)</th><th>Money in (deposit, transfer in)</th></tr>
+ * <tr><td>0&nbsp;–&nbsp;89 (grace)</td><td>allowed</td><td>allowed</td></tr>
+ * <tr><td>90&nbsp;–&nbsp;179</td><td>stopped</td><td>allowed</td></tr>
+ * <tr><td>180 and past</td><td>stopped</td><td>stopped</td></tr>
+ * </table>
+ *
+ * <p>
+ * Nothing at all is restricted during the grace window, and that is the point of it: RBI's 2021
+ * amendment is explicit that an account is not to be restricted merely because periodic KYC is
+ * pending, and that any restriction follows notice and a fair opportunity to comply. The customer
+ * is being chased, not shut out.
+ *
+ * <p>
+ * The line is drawn by direction, not by the counter the money crosses. Anything taking money out
+ * is stopped once debits stop — a transfer out is a withdrawal by another name — while anything
+ * paying money in keeps working, whether it is cash at the counter or a transfer from another
+ * account. A salary, a benefit, a relative sending funds: those must land, and none of them can
+ * move the balance anywhere while the debit side is shut.
+ *
+ * <h3>Why the days are counted rather than read off the account</h3>
+ *
+ * <p>
+ * The nightly job stamps the restriction on the savings account. Between a customer crossing a
+ * threshold and that job next running the account still reads as unrestricted, and a request
+ * raised in that window is accepted — the clerk is told it went through and the customer waits for
+ * money that was never going to be paid. Counting here closes that window, and matches the job so
+ * the two can never disagree.
+ */
+@Service
+@RequiredArgsConstructor
+public class KycRestrictionGuard {
+
+    private final JdbcTemplate jdbcTemplate;
+
+    /** What the caller is trying to do, which decides how far down the ladder it survives. */
+    public enum Operation {
+
+        /** Money out over the counter. Stopped once debits stop. */
+        DEBIT("Withdrawal"),
+        /** Money in, however it arrives. Allowed until the account is inoperative. */
+        CREDIT("Deposit"),
+        /** Money out to another account or a GL — a withdrawal by another name, so stopped with them. */
+        TRANSFER("Transfer");
+
+        private final String label;
+
+        Operation(final String label) {
+            this.label = label;
+        }
+
+        public String getLabel() {
+            return label;
+        }
+    }
+
+    /**
+     * Refuses the operation where the customer's re-KYC has lapsed far enough to stop it.
+     *
+     * <p>
+     * Silent for a null account, a client with no KYC record, and one whose KYC has no expiry date
+     * — none of those is a lapsed re-KYC, and refusing on absent data would block a counter over a
+     * record that was never set up.
+     *
+     * @throws PlatformDataIntegrityException naming the stage and what would lift it
+     */
+    public void check(final Long savingsAccountId, final Operation operation) {
+        checkDormancy(savingsAccountId, operation);
+        checkKycExpiry(savingsAccountId, operation);
+    }
+
+    private void checkKycExpiry(final Long savingsAccountId, final Operation operation) {
+        final Long daysOverdue = daysOverdue(savingsAccountId);
+        if (daysOverdue == null) {
+            return;
+        }
+        final KycExpiryStage stage = KycExpiryStage.fromDaysOverdue(daysOverdue);
+        if (stage == null || stage.isGrace()) {
+            // Inside the grace window nothing is restricted; the customer is only being chased.
+            return;
+        }
+        // Past grace, a credit is the one thing still let through, until the account is inoperative.
+        if (operation == Operation.CREDIT && !stage.isInoperative()) {
+            return;
+        }
+        throw new PlatformDataIntegrityException("error.msg.client.kyc.lapsed." + operation.name().toLowerCase(),
+                operation.getLabel() + " is not allowed. The customer's periodic re-KYC lapsed " + daysOverdue
+                        + " days ago. Complete the re-KYC to lift this.");
+    }
+
+    /**
+     * Refuses money leaving, or moving, on an account nobody has operated for the product's
+     * dormancy period.
+     *
+     * <p>
+     * Checked alongside the re-KYC ladder because the two restrict for the same reason and are
+     * lifted by the same act: an account untouched for two years is the one an impersonator
+     * reaches for, and RBI allows it to be operated again only once the customer's identity has
+     * been established afresh. Deposits are left alone — money coming in cannot be a fraud against
+     * the customer — but a transfer moves the balance somewhere a debit block does not follow, so
+     * it is refused in either direction.
+     *
+     * <p>
+     * The days are counted from the same clock the ladder measures, so an account that crossed the
+     * threshold before the nightly job stamped it is caught all the same.
+     */
+    private void checkDormancy(final Long savingsAccountId, final Operation operation) {
+        if (savingsAccountId == null || operation == Operation.CREDIT) {
+            return;
+        }
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT sp.days_to_dormancy,
+                       (SELECT date FROM m_business_date WHERE type = 'BUSINESS_DATE')
+                           - GREATEST(sa.activatedon_date,
+                               COALESCE((SELECT MAX(k.verified_on) FROM m_client_kyc k
+                                          WHERE k.client_id = sa.client_id AND k.verified_on IS NOT NULL),
+                                        sa.activatedon_date)) AS days_idle
+                  FROM m_savings_account sa
+                  JOIN m_savings_product sp ON sp.id = sa.product_id
+                 WHERE sa.id = ? AND sp.is_dormancy_tracking_active = true AND sp.days_to_dormancy > 0
+                """, savingsAccountId);
+        if (rows.isEmpty()) {
+            return;
+        }
+        final Number threshold = (Number) rows.get(0).get("days_to_dormancy");
+        final Number daysIdle = (Number) rows.get(0).get("days_idle");
+        if (threshold == null || daysIdle == null || daysIdle.longValue() < threshold.longValue()) {
+            return;
+        }
+        final long years = threshold.longValue() / 365;
+        final String period = years >= 1 ? years + (years == 1 ? " year" : " years") : threshold + " days";
+        throw new PlatformDataIntegrityException("error.msg.savings.account.dormant." + operation.name().toLowerCase(),
+                operation.getLabel() + " is not allowed. The account is dormant — no customer-initiated transaction for "
+                        + period + ". It must be reactivated after the customer's identity is re-verified (re-KYC).");
+    }
+
+    /**
+     * Days past the customer's re-KYC due date, or null where there is nothing overdue to measure.
+     *
+     * <p>
+     * Measured against the business date, not the wall clock, so a branch working a backdated day
+     * sees the restrictions that applied on that day.
+     */
+    public Long daysOverdue(final Long savingsAccountId) {
+        if (savingsAccountId == null) {
+            return null;
+        }
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT (SELECT date FROM m_business_date WHERE type = 'BUSINESS_DATE') - k.expiry_date AS days_overdue
+                  FROM m_savings_account sa
+                  JOIN m_client_kyc k ON k.client_id = sa.client_id
+                 WHERE sa.id = ? AND k.expiry_date IS NOT NULL
+                 ORDER BY k.expiry_date DESC
+                 LIMIT 1
+                """, savingsAccountId);
+        if (rows.isEmpty()) {
+            return null;
+        }
+        final Number daysOverdue = (Number) rows.get(0).get("days_overdue");
+        return daysOverdue == null || daysOverdue.longValue() < 0 ? null : daysOverdue.longValue();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/KycRiskRulesReadPlatformServiceImpl.java

@@ -66,6 +66,7 @@ public class KycRiskRulesReadPlatformServiceImpl implements KycRiskRulesReadPlat
         return new KycRiskRuleData(
             rule.getId(),
             rule.getRuleName(),
+            rule.isKycRule() ? ClientRiskRule.KIND_KYC : ClientRiskRule.KIND_AML,
             rule.getLegalFormId(),
             occCatId,
             occCatName,