Merge branch 'demo' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into uate

# Please enter a commit message to explain why this merge is necessary,
# especially if it merges an updated upstream into a topic branch.
#
# Lines starting with '#' will be ignored, and an empty message aborts
# the commit.

.gitignore

@@ -36,4 +36,5 @@ gradleExp/
 
 .windsurf/
 
+# Application logs
 fineract-provider/logs/

auth.json

@@ -0,0 +1 @@
+{"username":"mifos", "password":"password"}

fetch_accounts.js

@@ -0,0 +1,18 @@
+const https = require('https');
+const agent = new https.Agent({ rejectUnauthorized: false });
+
+fetch('https://localhost:8443/fineract-provider/api/v1/authentication?username=mifos&password=password&tenantIdentifier=default', {
+    method: 'POST',
+    agent: agent
+}).then(res => res.json()).then(data => {
+    const token = data.base64EncodedAuthenticationKey;
+    return fetch('https://localhost:8443/fineract-provider/api/v1/clients/9/accounts?tenantIdentifier=default', {
+        headers: {
+            'Authorization': 'Basic ' + token,
+            'Fineract-Platform-TenantId': 'default'
+        },
+        agent: agent
+    });
+}).then(res => res.json()).then(data => {
+    console.log(JSON.stringify(data, null, 2));
+}).catch(console.error);

fineract-accounting/src/main/java/org/apache/fineract/accounting/journalentry/JournalEntryMapper.java

@@ -18,7 +18,6 @@
  */
 package org.apache.fineract.accounting.journalentry;
 
-import java.time.OffsetDateTime;
 import org.apache.fineract.accounting.glaccount.domain.GLAccountType;
 import org.apache.fineract.accounting.journalentry.data.JournalEntryData;
 import org.apache.fineract.accounting.journalentry.domain.JournalEntry;

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/service/ProductToGLAccountMappingHelper.java

@@ -277,14 +277,14 @@ public class ProductToGLAccountMappingHelper {
         }
 
         final JsonArray chargeToIncomeAccountMappingArray = this.fromApiJsonHelper.extractJsonArrayNamed(arrayFragmentName, element);
-        /**
+        /*
          * Variable stores a map representation of charges (key) and their associated income Id's (value) extracted from
          * the passed in Jsoncommand
-         **/
+         */
         final Map<Long, Long> inputChargeToIncomeAccountMap = new HashMap<>();
-        /***
+        /*
          * Variable stores all charges which have already been mapped to Income Accounts in the system
-         **/
+         */
         final Set<Long> existingCharges = new HashSet<>();
         if (chargeToIncomeAccountMappingArray != null) {
             if (changes != null) {
@@ -301,13 +301,13 @@ public class ProductToGLAccountMappingHelper {
             // If input map is empty, delete all existing mappings
             if (inputChargeToIncomeAccountMap.size() == 0) {
                 this.accountMappingRepository.deleteAll(existingChargeToIncomeAccountMappings);
-            } /**
+            } /*
                * Else, <br/>
                * update existing mappings OR <br/>
                * delete old mappings (which are already present, but not passed in as a part of Jsoncommand)<br/>
                * Create new mappings for charges that are passed in as a part of the Jsoncommand but not already present
                *
-               **/
+               */
             else {
                 for (final ProductToGLAccountMapping chargeToIncomeAccountMapping : existingChargeToIncomeAccountMappings) {
                     final Long currentCharge = chargeToIncomeAccountMapping.getCharge().getId();
@@ -356,14 +356,14 @@ public class ProductToGLAccountMappingHelper {
                 .findAllPaymentTypeToFundSourceMappings(productId, portfolioProductType.getValue());
         final JsonArray paymentChannelMappingArray = this.fromApiJsonHelper
                 .extractJsonArrayNamed(LoanProductAccountingParams.PAYMENT_CHANNEL_FUND_SOURCE_MAPPING.getValue(), element);
-        /**
+        /*
          * Variable stores a map representation of Payment channels (key) and their fund sources (value) extracted from
          * the passed in Jsoncommand
-         **/
+         */
         final Map<Long, Long> inputPaymentChannelFundSourceMap = new HashMap<>();
-        /***
+        /*
          * Variable stores all payment types which have already been mapped to Fund Sources in the system
-         **/
+         */
         final Set<Long> existingPaymentTypes = new HashSet<>();
         if (paymentChannelMappingArray != null) {
             if (changes != null) {
@@ -381,14 +381,14 @@ public class ProductToGLAccountMappingHelper {
             // If input map is empty, delete all existing mappings
             if (inputPaymentChannelFundSourceMap.isEmpty()) {
                 this.accountMappingRepository.deleteAll(existingPaymentChannelToFundSourceMappings);
-            } /**
+            } /*
                * Else, <br/>
                * update existing mappings OR <br/>
                * delete old mappings (which re already present, but not passed in as a part of Jsoncommand)<br/>
                * Create new mappings for payment types that are passed in as a part of the Jsoncommand but not already
                * present
                *
-               **/
+               */
             else {
                 for (final ProductToGLAccountMapping existingPaymentChannelToFundSourceMapping : existingPaymentChannelToFundSourceMappings) {
                     final Long currentPaymentChannelId = existingPaymentChannelToFundSourceMapping.getPaymentType().getId();
@@ -584,9 +584,9 @@ public class ProductToGLAccountMappingHelper {
         // based on input condition
 
         GLAccount glAccount;
-        /**
+        /*
          * Both CASH and Accrual placeholders have the same value for income from Interest and penalties
-         **/
+         */
         CashAccountsForLoan placeHolderAccountType;
         if (isPenalty) {
             glAccount = getAccountByIdAndType(LoanProductAccountingParams.INCOME_ACCOUNT_ID.getValue(), GLAccountType.INCOME,

fineract-branch/src/main/java/org/apache/fineract/organisation/teller/api/TellerApiResource.java

@@ -181,12 +181,12 @@ public class TellerApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces(MediaType.APPLICATION_JSON)
     @Operation(summary = "Create Cashiers", description = """
-            Mandatory Fields:\s
+            Mandatory Fields:
             Cashier/staff, Fromm Date, To Date, Full Day or From time and To time
 
 
 
-            Optional Fields:\s
+            Optional Fields:
             Description/Notes""")
     @RequestBody(required = true, content = @Content(schema = @Schema(implementation = TellerApiResourceSwagger.PostTellersTellerIdCashiersRequest.class)))
     @ApiResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = TellerApiResourceSwagger.PostTellersTellerIdCashiersResponse.class)))

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandWrapperBuilder.java

@@ -71,6 +71,344 @@ public class CommandWrapperBuilder {
                 this.sanitizeJsonKeys);
     }
 
+    public CommandWrapperBuilder createChequeSeries() {
+        this.actionName = "CREATE";
+        this.entityName = "CHEQUESERIES";
+        this.entityId = null;
+        this.href = "/chequeseries";
+        return this;
+    }
+
+    public CommandWrapperBuilder updateChequeSeries(final Long seriesId) {
+        this.actionName = "UPDATE";
+        this.entityName = "CHEQUESERIES";
+        this.entityId = seriesId;
+        this.href = "/chequeseries/" + seriesId;
+        return this;
+    }
+
+    public CommandWrapperBuilder deleteChequeSeries(final Long seriesId) {
+        this.actionName = "DELETE";
+        this.entityName = "CHEQUESERIES";
+        this.entityId = seriesId;
+        this.href = "/chequeseries/" + seriesId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createChequeStockLot() {
+        this.actionName = "CREATE";
+        this.entityName = "CHEQUESTOCKLOT";
+        this.entityId = null;
+        this.href = "/chequestocklots";
+        return this;
+    }
+
+    public CommandWrapperBuilder reportLostChequeStockLot(final Long lotId) {
+        this.actionName = "REPORTLOST";
+        this.entityName = "CHEQUESTOCKLOT";
+        this.entityId = lotId;
+        this.href = "/chequestocklots/" + lotId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createChequeStockTransfer() {
+        this.actionName = "CREATE";
+        this.entityName = "CHEQUESTOCKTRANSFER";
+        this.entityId = null;
+        this.href = "/chequestocktransfers";
+        return this;
+    }
+
+    public CommandWrapperBuilder receiveChequeStockTransfer(final Long transferId) {
+        this.actionName = "RECEIVE";
+        this.entityName = "CHEQUESTOCKTRANSFER";
+        this.entityId = transferId;
+        this.href = "/chequestocktransfers/" + transferId;
+        return this;
+    }
+
+    public CommandWrapperBuilder rejectChequeStockTransfer(final Long transferId) {
+        this.actionName = "REJECT";
+        this.entityName = "CHEQUESTOCKTRANSFER";
+        this.entityId = transferId;
+        this.href = "/chequestocktransfers/" + transferId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createChequeBook() {
+        this.actionName = "CREATE";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = null;
+        this.href = "/chequebooks";
+        return this;
+    }
+
+    public CommandWrapperBuilder issueChequeBook(final Long chequeBookId) {
+        this.actionName = "ISSUE";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder rejectChequeBook(final Long chequeBookId) {
+        this.actionName = "REJECT";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder withdrawChequeBook(final Long chequeBookId) {
+        this.actionName = "WITHDRAW";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder stopPaymentChequeBook(final Long chequeBookId) {
+        this.actionName = "STOPPAYMENT";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder revokeStopPaymentChequeBook(final Long chequeBookId) {
+        this.actionName = "REVOKESTOPPAYMENT";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder reportLostChequeBook(final Long chequeBookId) {
+        this.actionName = "REPORTLOST";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder cancelLeafChequeBook(final Long chequeBookId) {
+        this.actionName = "CANCELLEAF";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder markUsedChequeBook(final Long chequeBookId) {
+        this.actionName = "MARKUSED";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder returnChequeBook(final Long chequeBookId) {
+        this.actionName = "RETURN";
+        this.entityName = "CHEQUEBOOK";
+        this.entityId = chequeBookId;
+        this.href = "/chequebooks/" + chequeBookId;
+        return this;
+    }
+
+    public CommandWrapperBuilder approveChequeBookPendingRequest(final Long pendingRequestId) {
+        this.actionName = "APPROVE";
+        this.entityName = "CHEQUEBOOKPENDINGREQUEST";
+        this.entityId = pendingRequestId;
+        this.href = "/chequebook/pending-requests/" + pendingRequestId;
+        return this;
+    }
+
+    public CommandWrapperBuilder rejectChequeBookPendingRequest(final Long pendingRequestId) {
+        this.actionName = "REJECT";
+        this.entityName = "CHEQUEBOOKPENDINGREQUEST";
+        this.entityId = pendingRequestId;
+        this.href = "/chequebook/pending-requests/" + pendingRequestId;
+        return this;
+    }
+
+    // ===== Clearing (CTS + NACH) command wrappers =====
+
+    public CommandWrapperBuilder createClearingSettlementBatch() {
+        this.actionName = "CREATE";
+        this.entityName = "CLEARINGSETTLEMENTBATCH";
+        this.entityId = null;
+        this.href = "/clearing/settlement-batches";
+        return this;
+    }
+
+    public CommandWrapperBuilder postClearingSettlementBatch(final Long settlementBatchId) {
+        this.actionName = "POST";
+        this.entityName = "CLEARINGSETTLEMENTBATCH";
+        this.entityId = settlementBatchId;
+        this.href = "/clearing/settlement-batches/" + settlementBatchId;
+        return this;
+    }
+
+    public CommandWrapperBuilder rejectClearingSettlementBatch(final Long settlementBatchId) {
+        this.actionName = "REJECT";
+        this.entityName = "CLEARINGSETTLEMENTBATCH";
+        this.entityId = settlementBatchId;
+        this.href = "/clearing/settlement-batches/" + settlementBatchId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createClearingReconciliation() {
+        this.actionName = "CREATE";
+        this.entityName = "CLEARINGRECONCILIATION";
+        this.entityId = null;
+        this.href = "/clearing/reconciliations";
+        return this;
+    }
+
+    public CommandWrapperBuilder createInwardClearingBatch() {
+        this.actionName = "CREATE";
+        this.entityName = "INWARDCLEARINGBATCH";
+        this.entityId = null;
+        this.href = "/ctsclearing/inward-batches";
+        return this;
+    }
+
+    public CommandWrapperBuilder validateInwardClearingBatch(final Long batchId) {
+        this.actionName = "VALIDATE";
+        this.entityName = "INWARDCLEARINGBATCH";
+        this.entityId = batchId;
+        this.href = "/ctsclearing/inward-batches/" + batchId;
+        return this;
+    }
+
+    public CommandWrapperBuilder passInwardClearingItem(final Long itemId) {
+        this.actionName = "PASS";
+        this.entityName = "INWARDCLEARINGITEM";
+        this.entityId = itemId;
+        this.href = "/ctsclearing/inward-items/" + itemId;
+        return this;
+    }
+
+    public CommandWrapperBuilder returnInwardClearingItem(final Long itemId) {
+        this.actionName = "RETURN";
+        this.entityName = "INWARDCLEARINGITEM";
+        this.entityId = itemId;
+        this.href = "/ctsclearing/inward-items/" + itemId;
+        return this;
+    }
+
+    public CommandWrapperBuilder verifyInwardClearingItemSignature(final Long itemId) {
+        this.actionName = "VERIFY_SIGNATURE";
+        this.entityName = "INWARDCLEARINGITEM";
+        this.entityId = itemId;
+        this.href = "/ctsclearing/inward-items/" + itemId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createPositivePayRegistration() {
+        this.actionName = "CREATE";
+        this.entityName = "POSITIVEPAYREGISTRATION";
+        this.entityId = null;
+        this.href = "/ctsclearing/positive-pay";
+        return this;
+    }
+
+    public CommandWrapperBuilder cancelPositivePayRegistration(final Long registrationId) {
+        this.actionName = "CANCEL";
+        this.entityName = "POSITIVEPAYREGISTRATION";
+        this.entityId = registrationId;
+        this.href = "/ctsclearing/positive-pay/" + registrationId;
+        return this;
+    }
+
+    public CommandWrapperBuilder sendPendingOutwardClearingBatch() {
+        this.actionName = "SENDBATCH";
+        this.entityName = "OUTWARDCLEARINGPRESENTMENT";
+        this.entityId = null;
+        this.href = "/ctsclearing/outward-presentments/send-pending-batch";
+        return this;
+    }
+
+    public CommandWrapperBuilder createOutwardClearingPresentment() {
+        this.actionName = "CREATE";
+        this.entityName = "OUTWARDCLEARINGPRESENTMENT";
+        this.entityId = null;
+        this.href = "/ctsclearing/outward-presentments";
+        return this;
+    }
+
+    public CommandWrapperBuilder sendOutwardClearingPresentment(final Long presentmentId) {
+        this.actionName = "SEND";
+        this.entityName = "OUTWARDCLEARINGPRESENTMENT";
+        this.entityId = presentmentId;
+        this.href = "/ctsclearing/outward-presentments/" + presentmentId;
+        return this;
+    }
+
+    public CommandWrapperBuilder settleOutwardClearingPresentment(final Long presentmentId) {
+        this.actionName = "SETTLE";
+        this.entityName = "OUTWARDCLEARINGPRESENTMENT";
+        this.entityId = presentmentId;
+        this.href = "/ctsclearing/outward-presentments/" + presentmentId;
+        return this;
+    }
+
+    public CommandWrapperBuilder dishonourOutwardClearingPresentment(final Long presentmentId) {
+        this.actionName = "DISHONOUR";
+        this.entityName = "OUTWARDCLEARINGPRESENTMENT";
+        this.entityId = presentmentId;
+        this.href = "/ctsclearing/outward-presentments/" + presentmentId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createNachMandate() {
+        this.actionName = "CREATE";
+        this.entityName = "NACHMANDATE";
+        this.entityId = null;
+        this.href = "/nachclearing/mandates";
+        return this;
+    }
+
+    public CommandWrapperBuilder cancelNachMandate(final Long mandateId) {
+        this.actionName = "CANCEL";
+        this.entityName = "NACHMANDATE";
+        this.entityId = mandateId;
+        this.href = "/nachclearing/mandates/" + mandateId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createNachBatch() {
+        this.actionName = "CREATE";
+        this.entityName = "NACHBATCH";
+        this.entityId = null;
+        this.href = "/nachclearing/batches";
+        return this;
+    }
+
+    public CommandWrapperBuilder processNachBatch(final Long batchId) {
+        this.actionName = "PROCESS";
+        this.entityName = "NACHBATCH";
+        this.entityId = batchId;
+        this.href = "/nachclearing/batches/" + batchId;
+        return this;
+    }
+
+    public CommandWrapperBuilder passNachTransaction(final Long transactionId) {
+        this.actionName = "PASS";
+        this.entityName = "NACHTRANSACTION";
+        this.entityId = transactionId;
+        this.href = "/nachclearing/transactions/" + transactionId;
+        return this;
+    }
+
+    public CommandWrapperBuilder returnNachTransaction(final Long transactionId) {
+        this.actionName = "RETURN";
+        this.entityName = "NACHTRANSACTION";
+        this.entityId = transactionId;
+        this.href = "/nachclearing/transactions/" + transactionId;
+        return this;
+    }
+
     public CommandWrapperBuilder updateCreditBureau() {
         this.actionName = "UPDATE";
         this.entityName = "ORGANISATIONCREDITBUREAU";
@@ -302,6 +640,14 @@ public class CommandWrapperBuilder {
         return this;
     }
 
+    public CommandWrapperBuilder createUserAgreement() {
+        this.actionName = "CREATE";
+        this.entityName = "USERAGREEMENT";
+        this.entityId = null;
+        this.href = "/useragreements";
+        return this;
+    }
+
     public CommandWrapperBuilder createOffice() {
         this.actionName = "CREATE";
         this.entityName = "OFFICE";

fineract-core/src/main/java/org/apache/fineract/infrastructure/core/serialization/GoogleGsonSerializerHelper.java

@@ -1,116 +1,150 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.fineract.infrastructure.core.serialization;
-
-import com.google.gson.ExclusionStrategy;
-import com.google.gson.Gson;
-import com.google.gson.GsonBuilder;
-import java.time.LocalDate;
-import java.time.LocalDateTime;
-import java.time.LocalTime;
-import java.time.MonthDay;
-import java.time.OffsetDateTime;
-import java.time.ZonedDateTime;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Set;
-import org.apache.fineract.infrastructure.core.api.DateAdapter;
-import org.apache.fineract.infrastructure.core.api.ExternalIdAdapter;
-import org.apache.fineract.infrastructure.core.api.JodaDateTimeAdapter;
-import org.apache.fineract.infrastructure.core.api.JodaMonthDayAdapter;
-import org.apache.fineract.infrastructure.core.api.LocalDateAdapter;
-import org.apache.fineract.infrastructure.core.api.LocalDateTimeAdapter;
-import org.apache.fineract.infrastructure.core.api.LocalTimeAdapter;
-import org.apache.fineract.infrastructure.core.api.OffsetDateTimeAdapter;
-import org.apache.fineract.infrastructure.core.api.ParameterListExclusionStrategy;
-import org.apache.fineract.infrastructure.core.api.ParameterListInclusionStrategy;
-import org.apache.fineract.infrastructure.core.domain.ExternalId;
-import org.apache.fineract.infrastructure.core.exception.UnsupportedParameterException;
-import org.springframework.stereotype.Service;
-
-/**
- * Helper class for serialization of Java objects into JSON using Google's GSON.
- */
-@Service
-public final class GoogleGsonSerializerHelper {
-
-    public Gson createGsonBuilderForPartialResponseFiltering(final Set<String> responseParameters) {
-        final ExclusionStrategy strategy = new ParameterListInclusionStrategy(responseParameters);
-
-        final GsonBuilder builder = new GsonBuilder().addSerializationExclusionStrategy(strategy);
-        registerTypeAdapters(builder);
-        return builder.create();
-    }
-
-    public Gson createGsonBuilderWithParameterExclusionSerializationStrategy(final Set<String> supportedParameters,
-            final Set<String> responseParameters) {
-
-        final Set<String> parameterNamesToSkip = new HashSet<>();
-
-        if (!responseParameters.isEmpty()) {
-            // strip out all known support parameters from expected response to
-            // see if unsupported parameters requested for response.
-            final Set<String> differentParametersDetectedSet = new HashSet<>(responseParameters);
-            differentParametersDetectedSet.removeAll(supportedParameters);
-
-            if (!differentParametersDetectedSet.isEmpty()) {
-                throw new UnsupportedParameterException(new ArrayList<>(differentParametersDetectedSet));
-            }
-
-            parameterNamesToSkip.addAll(supportedParameters);
-            parameterNamesToSkip.removeAll(responseParameters);
-        }
-
-        final ExclusionStrategy strategy = new ParameterListExclusionStrategy(parameterNamesToSkip);
-
-        final GsonBuilder builder = new GsonBuilder().addSerializationExclusionStrategy(strategy);
-        registerTypeAdapters(builder);
-        return builder.create();
-    }
-
-    public String serializedJsonFrom(final Gson serializer, final Object[] dataObjects) {
-        return serializer.toJson(dataObjects);
-    }
-
-    public String serializedJsonFrom(final Gson serializer, final Object singleDataObject) {
-        return serializer.toJson(singleDataObject);
-    }
-
-    public static Gson createSimpleGson() {
-        return createGsonBuilder().create();
-    }
-
-    public static GsonBuilder createGsonBuilder() {
-        final GsonBuilder builder = new GsonBuilder();
-        registerTypeAdapters(builder);
-        return builder;
-    }
-
-    public static void registerTypeAdapters(final GsonBuilder builder) {
-        builder.registerTypeAdapter(java.util.Date.class, new DateAdapter());
-        builder.registerTypeAdapter(LocalDate.class, new LocalDateAdapter());
-        // NOTE: was missing, necessary for GSON serialization with JDK 21's restrictive module access
-        builder.registerTypeAdapter(LocalTime.class, new LocalTimeAdapter());
-        builder.registerTypeAdapter(ZonedDateTime.class, new JodaDateTimeAdapter());
-        builder.registerTypeAdapter(MonthDay.class, new JodaMonthDayAdapter());
-        builder.registerTypeAdapter(LocalDateTime.class, new LocalDateTimeAdapter());
-        builder.registerTypeAdapter(OffsetDateTime.class, new OffsetDateTimeAdapter());
-        builder.registerTypeAdapter(ExternalId.class, new ExternalIdAdapter());
-    }
-}
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.core.serialization;
+
+import com.google.gson.ExclusionStrategy;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.TypeAdapter;
+import com.google.gson.TypeAdapterFactory;
+import com.google.gson.reflect.TypeToken;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import java.io.IOException;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.LocalTime;
+import java.time.MonthDay;
+import java.time.OffsetDateTime;
+import java.time.ZonedDateTime;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.Set;
+import org.apache.fineract.infrastructure.core.api.DateAdapter;
+import org.apache.fineract.infrastructure.core.api.ExternalIdAdapter;
+import org.apache.fineract.infrastructure.core.api.JodaDateTimeAdapter;
+import org.apache.fineract.infrastructure.core.api.JodaMonthDayAdapter;
+import org.apache.fineract.infrastructure.core.api.LocalDateAdapter;
+import org.apache.fineract.infrastructure.core.api.LocalDateTimeAdapter;
+import org.apache.fineract.infrastructure.core.api.LocalTimeAdapter;
+import org.apache.fineract.infrastructure.core.api.OffsetDateTimeAdapter;
+import org.apache.fineract.infrastructure.core.api.ParameterListExclusionStrategy;
+import org.apache.fineract.infrastructure.core.api.ParameterListInclusionStrategy;
+import org.apache.fineract.infrastructure.core.domain.ExternalId;
+import org.apache.fineract.infrastructure.core.exception.UnsupportedParameterException;
+import org.springframework.stereotype.Service;
+
+/**
+ * Helper class for serialization of Java objects into JSON using Google's GSON.
+ */
+@Service
+public final class GoogleGsonSerializerHelper {
+
+    public Gson createGsonBuilderForPartialResponseFiltering(final Set<String> responseParameters) {
+        final ExclusionStrategy strategy = new ParameterListInclusionStrategy(responseParameters);
+
+        final GsonBuilder builder = new GsonBuilder().addSerializationExclusionStrategy(strategy);
+        registerTypeAdapters(builder);
+        return builder.create();
+    }
+
+    public Gson createGsonBuilderWithParameterExclusionSerializationStrategy(final Set<String> supportedParameters,
+            final Set<String> responseParameters) {
+
+        final Set<String> parameterNamesToSkip = new HashSet<>();
+
+        if (!responseParameters.isEmpty()) {
+            // strip out all known support parameters from expected response to
+            // see if unsupported parameters requested for response.
+            final Set<String> differentParametersDetectedSet = new HashSet<>(responseParameters);
+            differentParametersDetectedSet.removeAll(supportedParameters);
+
+            if (!differentParametersDetectedSet.isEmpty()) {
+                throw new UnsupportedParameterException(new ArrayList<>(differentParametersDetectedSet));
+            }
+
+            parameterNamesToSkip.addAll(supportedParameters);
+            parameterNamesToSkip.removeAll(responseParameters);
+        }
+
+        final ExclusionStrategy strategy = new ParameterListExclusionStrategy(parameterNamesToSkip);
+
+        final GsonBuilder builder = new GsonBuilder().addSerializationExclusionStrategy(strategy);
+        registerTypeAdapters(builder);
+        return builder.create();
+    }
+
+    public String serializedJsonFrom(final Gson serializer, final Object[] dataObjects) {
+        return serializer.toJson(dataObjects);
+    }
+
+    public String serializedJsonFrom(final Gson serializer, final Object singleDataObject) {
+        return serializer.toJson(singleDataObject);
+    }
+
+    public static Gson createSimpleGson() {
+        return createGsonBuilder().create();
+    }
+
+    public static GsonBuilder createGsonBuilder() {
+        final GsonBuilder builder = new GsonBuilder();
+        registerTypeAdapters(builder);
+        return builder;
+    }
+
+    public static void registerTypeAdapters(final GsonBuilder builder) {
+        builder.registerTypeAdapter(java.util.Date.class, new DateAdapter());
+        builder.registerTypeAdapter(LocalDate.class, new LocalDateAdapter());
+        // NOTE: was missing, necessary for GSON serialization with JDK 21's restrictive module access
+        builder.registerTypeAdapter(LocalTime.class, new LocalTimeAdapter());
+        builder.registerTypeAdapter(ZonedDateTime.class, new JodaDateTimeAdapter());
+        builder.registerTypeAdapter(MonthDay.class, new JodaMonthDayAdapter());
+        builder.registerTypeAdapter(LocalDateTime.class, new LocalDateTimeAdapter());
+        builder.registerTypeAdapter(OffsetDateTime.class, new OffsetDateTimeAdapter());
+        builder.registerTypeAdapter(ExternalId.class, new ExternalIdAdapter());
+        // Use runtime type when serializing interface-typed fields (e.g. Collection<? extends IGuarantor>)
+        builder.registerTypeAdapterFactory(new TypeAdapterFactory() {
+            @Override
+            @SuppressWarnings("unchecked")
+            public <T> TypeAdapter<T> create(final Gson gson, final TypeToken<T> type) {
+                if (!type.getRawType().isInterface()) {
+                    return null;
+                }
+                final TypeAdapterFactory self = this;
+                return new TypeAdapter<T>() {
+                    @Override
+                    public void write(final JsonWriter out, final T value) throws IOException {
+                        if (value == null) {
+                            out.nullValue();
+                            return;
+                        }
+                        TypeAdapter<T> delegate = (TypeAdapter<T>) gson.getDelegateAdapter(self,
+                                TypeToken.get((Class<T>) value.getClass()));
+                        delegate.write(out, value);
+                    }
+
+                    @Override
+                    public T read(final JsonReader in) throws IOException {
+                        return null;
+                    }
+                };
+            }
+        });
+    }
+}

fineract-core/src/main/java/org/apache/fineract/infrastructure/documentmanagement/adapter/EntitySignatureIdAdapter.java

@@ -0,0 +1,56 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.documentmanagement.adapter;
+
+import java.io.Serial;
+import java.io.Serializable;
+import java.util.Optional;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+/**
+ * Decouples the entity "current signature" pointer from the generic document service, the same
+ * way {@link EntityImageIdAdapter} decouples the "current photo" pointer — lets
+ * DocumentWritePlatformServiceImpl (fineract-document module) give single-slot upsert semantics to
+ * signature uploads without depending on portfolio-module entities directly.
+ */
+public interface EntitySignatureIdAdapter {
+
+    /** @param documentName the m_document.name of the document being created/removed */
+    boolean accept(String entityType, String documentName);
+
+    Optional<SignatureIdResult> get(Long entityId);
+
+    Optional<SignatureIdResult> set(Long entityId, Long signatureId);
+
+    @Builder
+    @Data
+    @NoArgsConstructor
+    @AllArgsConstructor
+    class SignatureIdResult implements Serializable {
+
+        @Serial
+        private static final long serialVersionUID = 1L;
+
+        private Long id;
+        private String displayName;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/infrastructure/jobs/service/JobName.java

@@ -64,6 +64,9 @@ public enum JobName {
     IMPS_DEEMED_RECONCILE("IMPS DEEMED Reconciliation"), //
     NEFT_BATCH_PROCESS("NEFT Batch Process"), //
     VERIFICATION_TOKEN_CLEANUP("Verification Token Cleanup"), //
+    OUTWARD_CLEARING_BATCH_SEND("CTS Outward Clearing Batch Send"), //
+    CTR_REPORT_GENERATION("AML Monthly CTR Report Generation"), //
+    AML_STR_WEEKLY_DIGEST("AML STR Weekly Digest"), //
     ; //
 
     private final String name;

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlert.java

@@ -0,0 +1,160 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.useradministration.domain.AppUser;
+
+/**
+ * One row per {@link AmlTransactionRule} hit on a live transaction. Raised regardless of the
+ * client's current KYC risk category - alerting is never suppressed by a client being Low/Medium
+ * risk. First reviewed by an AML Officer (whitelist or escalate); an ESCALATED alert spawns an
+ * {@link AmlStrCase} for the Principal Officer.
+ */
+@Entity
+@Table(name = "m_aml_alert")
+public class AmlAlert extends AbstractAuditableWithUTCDateTimeCustom<Long> {
+
+    @Column(name = "transaction_type", nullable = false, length = 20)
+    private String transactionType;
+
+    @Column(name = "transaction_id", nullable = false)
+    private Long transactionId;
+
+    @ManyToOne
+    @JoinColumn(name = "client_id", nullable = false)
+    private Client client;
+
+    @ManyToOne
+    @JoinColumn(name = "rule_id", nullable = false)
+    private AmlTransactionRule rule;
+
+    @Column(name = "amount", nullable = false, precision = 19, scale = 6)
+    private BigDecimal amount;
+
+    @Column(name = "currency_code", length = 3)
+    private String currencyCode;
+
+    @Column(name = "raised_on", nullable = false)
+    private LocalDateTime raisedOn;
+
+    @Column(name = "status", nullable = false, length = 20)
+    private String status;
+
+    @ManyToOne
+    @JoinColumn(name = "reviewed_by")
+    private AppUser reviewedBy;
+
+    @Column(name = "reviewed_on")
+    private LocalDateTime reviewedOn;
+
+    @Column(name = "review_notes", length = 1000)
+    private String reviewNotes;
+
+    @Column(name = "disposition", length = 20)
+    private String disposition;
+
+    protected AmlAlert() {}
+
+    public static AmlAlert raise(AmlTransactionType transactionType, Long transactionId, Client client, AmlTransactionRule rule,
+            BigDecimal amount, String currencyCode, LocalDateTime raisedOn) {
+        final AmlAlert alert = new AmlAlert();
+        alert.transactionType = transactionType.name();
+        alert.transactionId = transactionId;
+        alert.client = client;
+        alert.rule = rule;
+        alert.amount = amount;
+        alert.currencyCode = currencyCode;
+        alert.raisedOn = raisedOn;
+        alert.status = AmlAlertStatus.RAISED.name();
+        return alert;
+    }
+
+    public void whitelist(AppUser reviewer, String notes) {
+        this.reviewedBy = reviewer;
+        this.reviewedOn = LocalDateTime.now();
+        this.reviewNotes = notes;
+        this.disposition = AmlAlertDisposition.WHITELIST.name();
+        this.status = AmlAlertStatus.WHITELISTED.name();
+    }
+
+    public void escalate(AppUser reviewer, String notes) {
+        this.reviewedBy = reviewer;
+        this.reviewedOn = LocalDateTime.now();
+        this.reviewNotes = notes;
+        this.disposition = AmlAlertDisposition.ESCALATE.name();
+        this.status = AmlAlertStatus.ESCALATED.name();
+    }
+
+    public Long getTransactionId() {
+        return transactionId;
+    }
+
+    public AmlTransactionType getTransactionType() {
+        return AmlTransactionType.valueOf(transactionType);
+    }
+
+    public Client getClient() {
+        return client;
+    }
+
+    public AmlTransactionRule getRule() {
+        return rule;
+    }
+
+    public BigDecimal getAmount() {
+        return amount;
+    }
+
+    public String getCurrencyCode() {
+        return currencyCode;
+    }
+
+    public LocalDateTime getRaisedOn() {
+        return raisedOn;
+    }
+
+    public AmlAlertStatus getStatus() {
+        return AmlAlertStatus.valueOf(status);
+    }
+
+    public AppUser getReviewedBy() {
+        return reviewedBy;
+    }
+
+    public LocalDateTime getReviewedOn() {
+        return reviewedOn;
+    }
+
+    public String getReviewNotes() {
+        return reviewNotes;
+    }
+
+    public AmlAlertDisposition getDisposition() {
+        return disposition == null ? null : AmlAlertDisposition.valueOf(disposition);
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlertDisposition.java

@@ -0,0 +1,25 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+/** The AML Officer's first-level disposition of an {@link AmlAlert}. */
+public enum AmlAlertDisposition {
+
+    WHITELIST, ESCALATE
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlertRepository.java

@@ -0,0 +1,38 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+public interface AmlAlertRepository extends JpaRepository<AmlAlert, Long> {
+
+    List<AmlAlert> findByStatusOrderByRaisedOnAsc(String status);
+
+    @Query("SELECT COALESCE(SUM(a.amount), 0) FROM AmlAlert a WHERE a.client.id = :clientId "
+            + "AND a.transactionType = :transactionType AND a.raisedOn >= :since")
+    BigDecimal sumAmountForClientSince(@Param("clientId") Long clientId, @Param("transactionType") String transactionType,
+            @Param("since") LocalDateTime since);
+
+    long countByClientId(Long clientId);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlertStatus.java

@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+public enum AmlAlertStatus {
+
+    RAISED, UNDER_REVIEW, WHITELISTED, ESCALATED
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAppliesTo.java

@@ -0,0 +1,29 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+/** Which transaction type(s) an {@link AmlTransactionRule} evaluates against. */
+public enum AmlAppliesTo {
+
+    SAVINGS, LOAN, TRANSFER, ALL;
+
+    public boolean matches(AmlTransactionType transactionType) {
+        return this == ALL || this.name().equals(transactionType.name());
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlCtrReport.java

@@ -0,0 +1,97 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Table;
+import java.time.LocalDateTime;
+import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+
+/**
+ * Monthly, mechanical CTR batch header - purely threshold-based (₹10L+ cash, individually or
+ * connected), no Principal Officer judgment involved. One row per calendar month.
+ */
+@Entity
+@Table(name = "m_aml_ctr_report")
+public class AmlCtrReport extends AbstractAuditableWithUTCDateTimeCustom<Long> {
+
+    @Column(name = "report_month", nullable = false, length = 7)
+    private String reportMonth;
+
+    @Column(name = "generated_on", nullable = false)
+    private LocalDateTime generatedOn;
+
+    @Column(name = "record_count", nullable = false)
+    private int recordCount;
+
+    @Column(name = "file_reference", length = 150)
+    private String fileReference;
+
+    @Column(name = "status", nullable = false, length = 20)
+    private String status;
+
+    @Column(name = "submitted_on")
+    private LocalDateTime submittedOn;
+
+    protected AmlCtrReport() {}
+
+    public static AmlCtrReport draft(String reportMonth, LocalDateTime generatedOn, int recordCount) {
+        final AmlCtrReport report = new AmlCtrReport();
+        report.reportMonth = reportMonth;
+        report.generatedOn = generatedOn;
+        report.recordCount = recordCount;
+        report.status = AmlCtrReportStatus.DRAFT.name();
+        return report;
+    }
+
+    public void markGenerated(String fileReference) {
+        this.fileReference = fileReference;
+        this.status = AmlCtrReportStatus.GENERATED.name();
+    }
+
+    public void markSubmitted(LocalDateTime submittedOn) {
+        this.submittedOn = submittedOn;
+        this.status = AmlCtrReportStatus.SUBMITTED.name();
+    }
+
+    public String getReportMonth() {
+        return reportMonth;
+    }
+
+    public LocalDateTime getGeneratedOn() {
+        return generatedOn;
+    }
+
+    public int getRecordCount() {
+        return recordCount;
+    }
+
+    public String getFileReference() {
+        return fileReference;
+    }
+
+    public AmlCtrReportStatus getStatus() {
+        return AmlCtrReportStatus.valueOf(status);
+    }
+
+    public LocalDateTime getSubmittedOn() {
+        return submittedOn;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlCtrReportLine.java

@@ -0,0 +1,103 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.math.BigDecimal;
+
+/**
+ * One line per transaction (or connected-transaction group, when {@link #connectedGroup} is true)
+ * feeding a monthly {@link AmlCtrReport}.
+ */
+@Entity
+@Table(name = "m_aml_ctr_report_line")
+public class AmlCtrReportLine {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne
+    @JoinColumn(name = "ctr_report_id", nullable = false)
+    private AmlCtrReport ctrReport;
+
+    @Column(name = "transaction_type", nullable = false, length = 20)
+    private String transactionType;
+
+    @Column(name = "transaction_id")
+    private Long transactionId;
+
+    @Column(name = "client_id", nullable = false)
+    private Long clientId;
+
+    @Column(name = "amount", nullable = false, precision = 19, scale = 6)
+    private BigDecimal amount;
+
+    @Column(name = "is_connected_group", nullable = false)
+    private boolean connectedGroup;
+
+    protected AmlCtrReportLine() {}
+
+    public static AmlCtrReportLine of(AmlCtrReport ctrReport, AmlTransactionType transactionType, Long transactionId, Long clientId,
+            BigDecimal amount, boolean connectedGroup) {
+        final AmlCtrReportLine line = new AmlCtrReportLine();
+        line.ctrReport = ctrReport;
+        line.transactionType = transactionType.name();
+        line.transactionId = transactionId;
+        line.clientId = clientId;
+        line.amount = amount;
+        line.connectedGroup = connectedGroup;
+        return line;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public AmlCtrReport getCtrReport() {
+        return ctrReport;
+    }
+
+    public AmlTransactionType getTransactionType() {
+        return AmlTransactionType.valueOf(transactionType);
+    }
+
+    public Long getTransactionId() {
+        return transactionId;
+    }
+
+    public Long getClientId() {
+        return clientId;
+    }
+
+    public BigDecimal getAmount() {
+        return amount;
+    }
+
+    public boolean isConnectedGroup() {
+        return connectedGroup;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlCtrReportLineRepository.java

@@ -0,0 +1,27 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface AmlCtrReportLineRepository extends JpaRepository<AmlCtrReportLine, Long> {
+
+    List<AmlCtrReportLine> findByCtrReport_Id(Long ctrReportId);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlCtrReportRepository.java

@@ -0,0 +1,27 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface AmlCtrReportRepository extends JpaRepository<AmlCtrReport, Long> {
+
+    Optional<AmlCtrReport> findByReportMonth(String reportMonth);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlCtrReportStatus.java

@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+public enum AmlCtrReportStatus {
+
+    DRAFT, GENERATED, SUBMITTED
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlRuleType.java

@@ -0,0 +1,33 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+/**
+ * How an {@link AmlTransactionRule} is evaluated.
+ *
+ * <ul>
+ * <li>THRESHOLD - a single transaction at or above {@code thresholdAmount}</li>
+ * <li>STRUCTURING - connected transactions summing at/above {@code thresholdAmount} within {@code windowDays}</li>
+ * <li>VELOCITY - unusual frequency of transactions within {@code windowDays}, independent of a fixed amount</li>
+ * </ul>
+ */
+public enum AmlRuleType {
+
+    THRESHOLD, STRUCTURING, VELOCITY
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrCase.java

@@ -0,0 +1,164 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.time.LocalDate;
+import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.useradministration.domain.AppUser;
+
+/**
+ * Created when an {@link AmlAlert} is escalated past first-level review. {@link #concludedOn} is
+ * the Principal Officer's conclusion date - the RBI-mandated 7-working-day FIU filing clock
+ * ({@link #fiuDueDate}) starts here, never at the alert or transaction date.
+ */
+@Entity
+@Table(name = "m_aml_str_case")
+public class AmlStrCase extends AbstractAuditableWithUTCDateTimeCustom<Long> {
+
+    @ManyToOne
+    @JoinColumn(name = "alert_id", nullable = false)
+    private AmlAlert alert;
+
+    @ManyToOne
+    @JoinColumn(name = "client_id", nullable = false)
+    private Client client;
+
+    @ManyToOne
+    @JoinColumn(name = "assigned_po")
+    private AppUser assignedPo;
+
+    @Column(name = "investigation_notes", length = 2000)
+    private String investigationNotes;
+
+    @Column(name = "source_of_funds_notes", length = 2000)
+    private String sourceOfFundsNotes;
+
+    @Column(name = "conclusion", length = 20)
+    private String conclusion;
+
+    @ManyToOne
+    @JoinColumn(name = "concluded_by")
+    private AppUser concludedBy;
+
+    @Column(name = "concluded_on")
+    private LocalDate concludedOn;
+
+    @Column(name = "fiu_due_date")
+    private LocalDate fiuDueDate;
+
+    @Column(name = "str_filed_on")
+    private LocalDate strFiledOn;
+
+    @Column(name = "str_reference_no", length = 100)
+    private String strReferenceNo;
+
+    @Column(name = "status", nullable = false, length = 25)
+    private String status;
+
+    protected AmlStrCase() {}
+
+    public static AmlStrCase openFor(AmlAlert alert) {
+        final AmlStrCase strCase = new AmlStrCase();
+        strCase.alert = alert;
+        strCase.client = alert.getClient();
+        strCase.status = AmlStrCaseStatus.OPEN.name();
+        return strCase;
+    }
+
+    public void assignPrincipalOfficer(AppUser po) {
+        this.assignedPo = po;
+    }
+
+    /** {@code fiuDueDate} is computed by the caller using the working-days calendar, not here. */
+    public void conclude(AppUser po, AmlStrConclusion conclusion, String investigationNotes, String sourceOfFundsNotes,
+            LocalDate concludedOn, LocalDate fiuDueDate) {
+        this.concludedBy = po;
+        this.conclusion = conclusion.name();
+        this.investigationNotes = investigationNotes;
+        this.sourceOfFundsNotes = sourceOfFundsNotes;
+        this.concludedOn = concludedOn;
+        this.status = conclusion == AmlStrConclusion.SUSPICIOUS ? AmlStrCaseStatus.CONCLUDED_SUSPICIOUS.name()
+                : AmlStrCaseStatus.CONCLUDED_CLEAR.name();
+        this.fiuDueDate = conclusion == AmlStrConclusion.SUSPICIOUS ? fiuDueDate : null;
+    }
+
+    public void fileStr(String referenceNo, LocalDate filedOn) {
+        this.strReferenceNo = referenceNo;
+        this.strFiledOn = filedOn;
+        this.status = AmlStrCaseStatus.FILED.name();
+    }
+
+    public Long getClientId() {
+        return client.getId();
+    }
+
+    public AmlAlert getAlert() {
+        return alert;
+    }
+
+    public Client getClient() {
+        return client;
+    }
+
+    public AppUser getAssignedPo() {
+        return assignedPo;
+    }
+
+    public String getInvestigationNotes() {
+        return investigationNotes;
+    }
+
+    public String getSourceOfFundsNotes() {
+        return sourceOfFundsNotes;
+    }
+
+    public AmlStrConclusion getConclusion() {
+        return conclusion == null ? null : AmlStrConclusion.valueOf(conclusion);
+    }
+
+    public AppUser getConcludedBy() {
+        return concludedBy;
+    }
+
+    public LocalDate getConcludedOn() {
+        return concludedOn;
+    }
+
+    public LocalDate getFiuDueDate() {
+        return fiuDueDate;
+    }
+
+    public LocalDate getStrFiledOn() {
+        return strFiledOn;
+    }
+
+    public String getStrReferenceNo() {
+        return strReferenceNo;
+    }
+
+    public AmlStrCaseStatus getStatus() {
+        return AmlStrCaseStatus.valueOf(status);
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrCaseRepository.java

@@ -0,0 +1,38 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.time.LocalDate;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+public interface AmlStrCaseRepository extends JpaRepository<AmlStrCase, Long> {
+
+    long countByClient_Id(Long clientId);
+
+    List<AmlStrCase> findByStatus(String status);
+
+    @Query("SELECT c FROM AmlStrCase c WHERE c.status = 'CONCLUDED_SUSPICIOUS' AND c.concludedOn BETWEEN :from AND :to")
+    List<AmlStrCase> findConcludedSuspiciousBetween(@Param("from") LocalDate from, @Param("to") LocalDate to);
+
+    @Query("SELECT c FROM AmlStrCase c WHERE c.status = 'CONCLUDED_SUSPICIOUS' AND c.fiuDueDate < :asOf")
+    List<AmlStrCase> findOverdueForFiling(@Param("asOf") LocalDate asOf);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrCaseStatus.java

@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+public enum AmlStrCaseStatus {
+
+    OPEN, CONCLUDED_CLEAR, CONCLUDED_SUSPICIOUS, FILED
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrConclusion.java

@@ -0,0 +1,25 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+/** The Principal Officer's final conclusion on an {@link AmlStrCase}. */
+public enum AmlStrConclusion {
+
+    NOT_SUSPICIOUS, SUSPICIOUS
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlTransactionRule.java

@@ -0,0 +1,104 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import java.math.BigDecimal;
+
+/**
+ * A machine-evaluable transaction-monitoring rule. Distinct from {@code ClientRiskRule}
+ * (client-profile, KYC-time scoring) - these are checked against live savings/loan/transfer
+ * transactions as they post. {@link #sourceClientRiskRuleId} optionally traces a rule back to its
+ * originating entry in the 221-rule AML catalog seeded in {@code m_client_risk_rule}.
+ */
+@Entity
+@Table(name = "m_aml_transaction_rule")
+public class AmlTransactionRule {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "rule_code", nullable = false, length = 50)
+    private String ruleCode;
+
+    @Column(name = "description", nullable = false, length = 500)
+    private String description;
+
+    @Column(name = "applies_to", nullable = false, length = 20)
+    private String appliesTo;
+
+    @Column(name = "threshold_amount", precision = 19, scale = 6)
+    private BigDecimal thresholdAmount;
+
+    @Column(name = "rule_type", nullable = false, length = 20)
+    private String ruleType;
+
+    @Column(name = "window_days")
+    private Integer windowDays;
+
+    @Column(name = "source_client_risk_rule_id")
+    private Long sourceClientRiskRuleId;
+
+    @Column(name = "is_active", nullable = false)
+    private boolean active;
+
+    protected AmlTransactionRule() {}
+
+    public Long getId() {
+        return id;
+    }
+
+    public String getRuleCode() {
+        return ruleCode;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public AmlAppliesTo getAppliesTo() {
+        return AmlAppliesTo.valueOf(appliesTo);
+    }
+
+    public BigDecimal getThresholdAmount() {
+        return thresholdAmount;
+    }
+
+    public AmlRuleType getRuleType() {
+        return AmlRuleType.valueOf(ruleType);
+    }
+
+    public Integer getWindowDays() {
+        return windowDays;
+    }
+
+    public Long getSourceClientRiskRuleId() {
+        return sourceClientRiskRuleId;
+    }
+
+    public boolean isActive() {
+        return active;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlTransactionRuleRepository.java

@@ -0,0 +1,27 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface AmlTransactionRuleRepository extends JpaRepository<AmlTransactionRule, Long> {
+
+    List<AmlTransactionRule> findByActiveTrueAndAppliesTo(String appliesTo);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlTransactionType.java

@@ -0,0 +1,25 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+/** The kind of ledger transaction an {@link AmlAlert} was raised against. */
+public enum AmlTransactionType {
+
+    SAVINGS, LOAN, TRANSFER
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/ClientRiskCategoryHistory.java

@@ -0,0 +1,138 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.time.LocalDateTime;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.useradministration.domain.AppUser;
+
+/**
+ * Immutable, append-only audit trail of a client's KYC risk-category changes. Backs the AML menu's
+ * existing "Risk Update History Report" item, which previously had no data behind it. Written both
+ * for manual re-categorization and for the automatic escalation triggered on a client's 3rd
+ * cumulative {@link AmlStrCase}.
+ */
+@Entity
+@Table(name = "m_client_risk_category_history")
+public class ClientRiskCategoryHistory {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne
+    @JoinColumn(name = "client_id", nullable = false)
+    private Client client;
+
+    @Column(name = "previous_category", nullable = false)
+    private Integer previousCategory;
+
+    @Column(name = "new_category", nullable = false)
+    private Integer newCategory;
+
+    @Column(name = "reason", nullable = false, length = 500)
+    private String reason;
+
+    @Column(name = "triggered_by", nullable = false, length = 30)
+    private String triggeredBy;
+
+    @ManyToOne
+    @JoinColumn(name = "str_case_id")
+    private AmlStrCase strCase;
+
+    @Column(name = "changed_on", nullable = false)
+    private LocalDateTime changedOn;
+
+    @ManyToOne
+    @JoinColumn(name = "changed_by", nullable = false)
+    private AppUser changedBy;
+
+    protected ClientRiskCategoryHistory() {}
+
+    public static ClientRiskCategoryHistory autoEscalation(Client client, Integer previousCategory, Integer newCategory,
+            AmlStrCase triggeringCase, AppUser systemActor, LocalDateTime changedOn) {
+        final ClientRiskCategoryHistory history = new ClientRiskCategoryHistory();
+        history.client = client;
+        history.previousCategory = previousCategory;
+        history.newCategory = newCategory;
+        history.reason = "Auto-escalated after client's 3rd cumulative AML STR case (case #" + triggeringCase.getId() + ")";
+        history.triggeredBy = RiskCategoryChangeTrigger.AML_AUTO_ESCALATION.name();
+        history.strCase = triggeringCase;
+        history.changedOn = changedOn;
+        history.changedBy = systemActor;
+        return history;
+    }
+
+    public static ClientRiskCategoryHistory manual(Client client, Integer previousCategory, Integer newCategory, String reason,
+            AppUser changedBy, LocalDateTime changedOn) {
+        final ClientRiskCategoryHistory history = new ClientRiskCategoryHistory();
+        history.client = client;
+        history.previousCategory = previousCategory;
+        history.newCategory = newCategory;
+        history.reason = reason;
+        history.triggeredBy = RiskCategoryChangeTrigger.MANUAL.name();
+        history.changedBy = changedBy;
+        history.changedOn = changedOn;
+        return history;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public Client getClient() {
+        return client;
+    }
+
+    public Integer getPreviousCategory() {
+        return previousCategory;
+    }
+
+    public Integer getNewCategory() {
+        return newCategory;
+    }
+
+    public String getReason() {
+        return reason;
+    }
+
+    public RiskCategoryChangeTrigger getTriggeredBy() {
+        return RiskCategoryChangeTrigger.valueOf(triggeredBy);
+    }
+
+    public AmlStrCase getStrCase() {
+        return strCase;
+    }
+
+    public LocalDateTime getChangedOn() {
+        return changedOn;
+    }
+
+    public AppUser getChangedBy() {
+        return changedBy;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/ClientRiskCategoryHistoryRepository.java

@@ -0,0 +1,27 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface ClientRiskCategoryHistoryRepository extends JpaRepository<ClientRiskCategoryHistory, Long> {
+
+    List<ClientRiskCategoryHistory> findByClient_IdOrderByChangedOnDesc(Long clientId);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/RiskCategoryChangeTrigger.java

@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+public enum RiskCategoryChangeTrigger {
+
+    AML_AUTO_ESCALATION, MANUAL
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/cfcfrms/domain/CfcfrmsSimulatorLog.java

@@ -23,6 +23,7 @@ import jakarta.persistence.Entity;
 import jakarta.persistence.Table;
 import java.time.OffsetDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * Simulator-side audit log for CFCFRMS (I4C/MHA) events.
@@ -69,7 +70,7 @@ public class CfcfrmsSimulatorLog extends AbstractAuditableWithUTCDateTimeCustom<
         this.eventType = eventType;
         this.payload = payload;
         this.responsePayload = responsePayload;
-        this.eventTimestamp = OffsetDateTime.now();
+        this.eventTimestamp = DateUtils.getOffsetDateTimeOfTenant();
     }
 
     public CfcfrmsSimulatorLog(final String cfcfrmsRef, final String ticketId, final String bankIfsc,

fineract-core/src/main/java/org/apache/fineract/portfolio/cfcfrms/domain/ComplaintAuditLog.java

@@ -23,6 +23,7 @@ import jakarta.persistence.Entity;
 import jakarta.persistence.Table;
 import java.time.OffsetDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * Audit trail for every status change on a CFCFRMS complaint ticket.
@@ -54,7 +55,7 @@ public class ComplaintAuditLog extends AbstractAuditableWithUTCDateTimeCustom<Lo
         this.event = event;
         this.description = description;
         this.actor = actor;
-        this.eventTimestamp = OffsetDateTime.now();
+        this.eventTimestamp = DateUtils.getOffsetDateTimeOfTenant();
     }
 
     public ComplaintAuditLog(final String ticketId, final String event, final String description,

fineract-core/src/main/java/org/apache/fineract/portfolio/cfcfrms/domain/ComplaintTicket.java

@@ -26,6 +26,7 @@ import jakarta.persistence.Table;
 import java.math.BigDecimal;
 import java.time.OffsetDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * CFCFRMS Complaint Ticket — represents a cyber fraud complaint pushed by MHA/I4C to the bank.
@@ -121,7 +122,7 @@ public class ComplaintTicket extends AbstractAuditableWithUTCDateTimeCustom<Long
         ticket.status = ComplaintStatus.RECEIVED;
         ticket.assignedOfficer = assignedOfficer;
         ticket.statePoliceRef = statePoliceRef;
-        ticket.receivedAt = OffsetDateTime.now();
+        ticket.receivedAt = DateUtils.getOffsetDateTimeOfTenant();
         return ticket;
     }
 
@@ -132,7 +133,7 @@ public class ComplaintTicket extends AbstractAuditableWithUTCDateTimeCustom<Long
         this.status = newStatus;
         this.actionTaken = actionNote;
         if (newStatus == ComplaintStatus.RESOLVED || newStatus == ComplaintStatus.REJECTED) {
-            this.resolvedAt = OffsetDateTime.now();
+            this.resolvedAt = DateUtils.getOffsetDateTimeOfTenant();
         }
     }
 

fineract-core/src/main/java/org/apache/fineract/portfolio/client/adapter/ClientSignatureIdAdapter.java

@@ -0,0 +1,66 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.adapter;
+
+import static java.util.Objects.nonNull;
+
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.documentmanagement.adapter.EntitySignatureIdAdapter;
+import org.apache.fineract.portfolio.client.domain.ClientRepository;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
+
+@Slf4j
+@RequiredArgsConstructor
+@Component
+class ClientSignatureIdAdapter implements EntitySignatureIdAdapter {
+
+    private static final String ENTITY_TYPE = "clients";
+    private static final String DOCUMENT_NAME = "clientSignature";
+
+    private final ClientRepository repository;
+
+    @Override
+    public boolean accept(String entityType, String documentName) {
+        return ENTITY_TYPE.equalsIgnoreCase(entityType) && DOCUMENT_NAME.equalsIgnoreCase(documentName);
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public Optional<SignatureIdResult> get(Long entityId) {
+        return repository.findById(entityId).filter(client -> nonNull(client.getSignatureId()))
+                .map(client -> SignatureIdResult.builder().id(client.getSignatureId()).displayName(client.getDisplayName()).build());
+    }
+
+    @Override
+    @Transactional
+    public Optional<SignatureIdResult> set(Long entityId, Long signatureId) {
+        final var result = get(entityId);
+
+        if (signatureId == null) {
+            repository.removeSignatureId(entityId);
+        } else {
+            repository.updateByIdAndSignatureId(entityId, signatureId);
+        }
+
+        return result;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/client/api/ClientApiConstants.java

@@ -63,6 +63,7 @@ public class ClientApiConstants {
     public static final String CLIENT_CLASSIFICATION = "ClientClassification";
 
     public static final String OCCUPATION_CATEGORY = "OccupationCategory";
+    public static final String PWD_CATEGORY = "PwdCategory";
     public static final String OCCUPATION = "Occupation";
 
     public static final String CLIENT_NON_PERSON_CONSTITUTION = "Constitution";
@@ -96,6 +97,15 @@ public class ClientApiConstants {
     public static final String mobileNoParamName = "mobileNo";
     public static final String alternateMobileNoParamName = "alternateMobileNo";
     public static final String emailAddressParamName = "emailAddress";
+    // Dual-OTP contact-change verification (see ClientContactOtpService) — required only when
+    // mobileNo or emailAddress is being changed via PUT /clients/{id}. Reference an already
+    // VERIFIED m_otp_log row for the OLD destination (current DB value) and the NEW destination
+    // (incoming value) respectively. Field-specific (not a single generic pair) so mobileNo and
+    // emailAddress can both change in the same request without ambiguity.
+    public static final String mobileOldOtpIdParamName = "mobileOldOtpId";
+    public static final String mobileNewOtpIdParamName = "mobileNewOtpId";
+    public static final String emailOldOtpIdParamName = "emailOldOtpId";
+    public static final String emailNewOtpIdParamName = "emailNewOtpId";
     public static final String firstnameParamName = "firstname";
     public static final String middlenameParamName = "middlename";
     public static final String lastnameParamName = "lastname";
@@ -138,7 +148,13 @@ public class ClientApiConstants {
     public static final String religionParamName = "religion";
     public static final String socialCategoryParamName = "socialCategory";
     public static final String monthlyIncomeParamName = "monthlyIncome";
+    public static final String annualIncomeParamName = "annualIncome";
     public static final String annualTurnoverParamName = "annualTurnover";
+    public static final String monthlyTurnoverParamName = "monthlyTurnover";
+    public static final String isSeniorCitizenParamName = "isSeniorCitizen";
+    public static final String isPwdParamName = "isPwd";
+    public static final String pwdCategoryIdParamName = "pwdCategoryId";
+    public static final String pwdCategoryParamName = "pwdCategory";
     public static final String agricultureIncomeParamName = "agricultureIncome";
     public static final String nonAgricultureIncomeParamName = "nonAgricultureIncome";
     public static final String ageYearsParamName = "ageYears";
@@ -248,8 +264,9 @@ public class ClientApiConstants {
             staffOptionsParamName, dateOfBirthParamName, genderParamName, clientTypeParamName, clientClassificationParamName,
             salutationParamName, occupationCategoryParamName, occupationParamName, maritalStatusParamName,
             educationLevelParamName, degreeQualificationParamName,
-            religionParamName, socialCategoryParamName, monthlyIncomeParamName,
-            annualTurnoverParamName, agricultureIncomeParamName, nonAgricultureIncomeParamName,
+            religionParamName, socialCategoryParamName, monthlyIncomeParamName, annualIncomeParamName,
+            annualTurnoverParamName, monthlyTurnoverParamName, agricultureIncomeParamName, nonAgricultureIncomeParamName,
+            isSeniorCitizenParamName, isPwdParamName, pwdCategoryParamName,
             ageYearsParamName, ageMonthsParamName, ageDaysParamName,
             nationalityIdParamName, isMinorParamName, guardianClientIdParamName, guardianClientDisplayNameParamName, guardianRelationParamName,
             dipVerifiedParamName, dipLookupLogIdParamName, dipTimestampParamName,

fineract-core/src/main/java/org/apache/fineract/portfolio/client/data/ClientData.java

@@ -82,7 +82,13 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
     private CodeValueData religion;
     private CodeValueData socialCategory;
     private BigDecimal monthlyIncome;
+    private BigDecimal annualIncome;
     private BigDecimal annualTurnover;
+    private BigDecimal monthlyTurnover;
+    private Boolean isSeniorCitizen;
+    private Boolean isPwd;
+    private CodeValueData pwdCategory;
+    private Collection<CodeValueData> pwdCategoryOptions;
     private BigDecimal agricultureIncome;
     private BigDecimal nonAgricultureIncome;
     private Integer ageYears;
@@ -400,13 +406,19 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
         data.degreeQualificationOptions = templateData.degreeQualificationOptions;
         data.religionOptions = templateData.religionOptions;
         data.socialCategoryOptions = templateData.socialCategoryOptions;
+        data.pwdCategoryOptions = templateData.pwdCategoryOptions;
         data.maritalStatus = clientData.maritalStatus;
         data.educationLevel = clientData.educationLevel;
         data.degreeQualification = clientData.degreeQualification;
         data.religion = clientData.religion;
         data.socialCategory = clientData.socialCategory;
         data.monthlyIncome = clientData.monthlyIncome;
+        data.annualIncome = clientData.annualIncome;
         data.annualTurnover = clientData.annualTurnover;
+        data.monthlyTurnover = clientData.monthlyTurnover;
+        data.isSeniorCitizen = clientData.isSeniorCitizen;
+        data.isPwd = clientData.isPwd;
+        data.pwdCategory = clientData.pwdCategory;
         data.agricultureIncome = clientData.agricultureIncome;
         data.nonAgricultureIncome = clientData.nonAgricultureIncome;
         data.ageYears = clientData.ageYears;
@@ -456,13 +468,19 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
         data.degreeQualificationOptions = clientData.degreeQualificationOptions;
         data.religionOptions = clientData.religionOptions;
         data.socialCategoryOptions = clientData.socialCategoryOptions;
+        data.pwdCategoryOptions = clientData.pwdCategoryOptions;
         data.maritalStatus = clientData.maritalStatus;
         data.educationLevel = clientData.educationLevel;
         data.degreeQualification = clientData.degreeQualification;
         data.religion = clientData.religion;
         data.socialCategory = clientData.socialCategory;
         data.monthlyIncome = clientData.monthlyIncome;
+        data.annualIncome = clientData.annualIncome;
         data.annualTurnover = clientData.annualTurnover;
+        data.monthlyTurnover = clientData.monthlyTurnover;
+        data.isSeniorCitizen = clientData.isSeniorCitizen;
+        data.isPwd = clientData.isPwd;
+        data.pwdCategory = clientData.pwdCategory;
         data.agricultureIncome = clientData.agricultureIncome;
         data.nonAgricultureIncome = clientData.nonAgricultureIncome;
         data.ageYears = clientData.ageYears;
@@ -509,7 +527,12 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
         data.religion = clientData.religion;
         data.socialCategory = clientData.socialCategory;
         data.monthlyIncome = clientData.monthlyIncome;
+        data.annualIncome = clientData.annualIncome;
         data.annualTurnover = clientData.annualTurnover;
+        data.monthlyTurnover = clientData.monthlyTurnover;
+        data.isSeniorCitizen = clientData.isSeniorCitizen;
+        data.isPwd = clientData.isPwd;
+        data.pwdCategory = clientData.pwdCategory;
         data.agricultureIncome = clientData.agricultureIncome;
         data.nonAgricultureIncome = clientData.nonAgricultureIncome;
         data.ageYears = clientData.ageYears;

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/Client.java

@@ -77,6 +77,9 @@ public class Client extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     @Column(name = "image_id")
     private Long imageId;
 
+    @Column(name = "signature_id")
+    private Long signatureId;
+
     @Column(name = "status_enum", nullable = false)
     private Integer status;
 
@@ -231,9 +234,25 @@ public class Client extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     @Column(name = "monthly_income")
     private java.math.BigDecimal monthlyIncome;
 
+    @Column(name = "annual_income")
+    private java.math.BigDecimal annualIncome;
+
     @Column(name = "annual_turnover")
     private java.math.BigDecimal annualTurnover;
 
+    @Column(name = "monthly_turnover")
+    private java.math.BigDecimal monthlyTurnover;
+
+    @Column(name = "is_senior_citizen")
+    private Boolean isSeniorCitizen;
+
+    @Column(name = "is_pwd")
+    private Boolean isPwd;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "pwd_category_cv_id")
+    private CodeValue pwdCategory;
+
     @Column(name = "agriculture_income")
     private java.math.BigDecimal agricultureIncome;
 
@@ -598,6 +617,10 @@ public class Client extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         return this.office.getId();
     }
 
+    public String getDisplayName() {
+        return this.displayName;
+    }
+
     public String mobileNo() {
         return this.mobileNo;
     }
@@ -832,6 +855,14 @@ public class Client extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         return this.socialCategory != null ? this.socialCategory.getId() : null;
     }
 
+    public Long pwdCategoryId() {
+        return this.pwdCategory != null ? this.pwdCategory.getId() : null;
+    }
+
+    public void updatePwdCategory(CodeValue pwdCategory) {
+        this.pwdCategory = pwdCategory;
+    }
+
     public void updateSocialCategory(CodeValue socialCategory) {
         this.socialCategory = socialCategory;
     }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientForm60.java

@@ -29,6 +29,7 @@ import lombok.Getter;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.infrastructure.core.api.JsonCommand;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * Form 60 declaration as per Rule 114B of Income Tax Rules, 1962.
@@ -87,7 +88,7 @@ public class ClientForm60 extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         form.estimatedTotalIncome = command.bigDecimalValueOfParameterNamed("estimatedTotalIncome");
         form.reasonForNoPan = StringUtils.defaultIfEmpty(command.stringValueOfParameterNamed("reasonForNoPan"), null);
         form.declaration = command.booleanPrimitiveValueOfParameterNamed("declaration");
-        form.submittedOn = LocalDate.now();
+        form.submittedOn = DateUtils.getLocalDateOfTenant();
         return form;
     }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientKyc.java

@@ -32,6 +32,7 @@ import java.util.Map;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.infrastructure.core.api.JsonCommand;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * Represents a client's KYC (Know Your Customer) record as mandated by the Reserve Bank of India
@@ -260,7 +261,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         this.gstinVerified = false;
         this.cinVerified = false;
         this.dinVerified = false;
-        this.initiatedOn = LocalDate.now();
+        this.initiatedOn = DateUtils.getLocalDateOfTenant();
     }
 
     public static ClientKyc initiateKyc(final Client client, final JsonCommand command) {
@@ -456,13 +457,13 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     public void markCkycUploaded(final String ckycNumber, final String batchId) {
         this.ckycNumber = StringUtils.defaultIfEmpty(ckycNumber, null);
         this.ckycBatchId = StringUtils.defaultIfEmpty(batchId, null);
-        this.ckycUploadedOn = LocalDate.now();
+        this.ckycUploadedOn = DateUtils.getLocalDateOfTenant();
     }
 
     /** Called after successful 3rd-party verification of all required documents. */
     public void markVerified(final String ckycNumber) {
         this.kycStatus = ClientKycStatus.VERIFIED.getValue();
-        this.verifiedOn = LocalDate.now();
+        this.verifiedOn = DateUtils.getLocalDateOfTenant();
         this.ckycNumber = StringUtils.defaultIfEmpty(ckycNumber, null);
 
         final KycRiskCategory risk = KycRiskCategory.fromInt(this.riskCategory);
@@ -474,14 +475,14 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     /** Called when verification fails. */
     public void markRejected(final String remarks) {
         this.kycStatus = ClientKycStatus.REJECTED.getValue();
-        this.rejectedOn = LocalDate.now();
+        this.rejectedOn = DateUtils.getLocalDateOfTenant();
         this.remarks = StringUtils.defaultIfEmpty(remarks, this.remarks);
     }
 
     public void markPanVerified(final String fullName, final String firstName, final String lastName,
             final String aadhaarSeedingStatus, final String category, final String status) {
         this.panVerified = true;
-        this.panVerifiedOn = LocalDate.now();
+        this.panVerifiedOn = DateUtils.getLocalDateOfTenant();
         this.panFullName = StringUtils.defaultIfEmpty(fullName, null);
         this.panFirstName = StringUtils.defaultIfEmpty(firstName, null);
         this.panLastName = StringUtils.defaultIfEmpty(lastName, null);
@@ -507,28 +508,28 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
 
     public void markAadhaarVerified() {
         this.aadhaarVerified = true;
-        this.aadhaarVerifiedOn = LocalDate.now();
+        this.aadhaarVerifiedOn = DateUtils.getLocalDateOfTenant();
     }
 
     public void markGstinVerified() {
         this.gstinVerified = true;
-        this.gstinVerifiedOn = LocalDate.now();
+        this.gstinVerifiedOn = DateUtils.getLocalDateOfTenant();
     }
 
     public void markCinVerified() {
         this.cinVerified = true;
-        this.cinVerifiedOn = LocalDate.now();
+        this.cinVerifiedOn = DateUtils.getLocalDateOfTenant();
     }
 
     public void markDinVerified() {
         this.dinVerified = true;
-        this.dinVerifiedOn = LocalDate.now();
+        this.dinVerifiedOn = DateUtils.getLocalDateOfTenant();
     }
 
     public void markDinVerified(final String dinNumber, final String mcaResponseJson) {
         this.dinNumber = dinNumber;
         this.dinVerified = true;
-        this.dinVerifiedOn = LocalDate.now();
+        this.dinVerifiedOn = DateUtils.getLocalDateOfTenant();
         this.isDirector = true;
         this.dinMcaResponse = mcaResponseJson;
     }
@@ -585,6 +586,15 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         return riskCategory;
     }
 
+    /**
+     * Directly sets the risk category outside the normal command-diff update path. Used by the AML
+     * module to auto-escalate a client's risk category after their 3rd cumulative STR case -
+     * every such change is recorded in {@code m_client_risk_category_history} by the caller.
+     */
+    public void escalateRiskCategory(Integer newCategory) {
+        this.riskCategory = newCategory;
+    }
+
     public String getPanNumber() {
         return panNumber;
     }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientRepository.java

@@ -55,6 +55,14 @@ public interface ClientRepository extends JpaRepository<Client, Long>, JpaSpecif
     @Query("UPDATE Client client SET client.imageId = null WHERE client.id = :clientId")
     void removeImageId(@Param("clientId") Long clientId);
 
+    @Modifying
+    @Query("UPDATE Client client SET client.signatureId = :signatureId WHERE client.id = :clientId")
+    void updateByIdAndSignatureId(@Param("clientId") Long clientId, @Param("signatureId") Long signatureId);
+
+    @Modifying
+    @Query("UPDATE Client client SET client.signatureId = null WHERE client.id = :clientId")
+    void removeSignatureId(@Param("clientId") Long clientId);
+
     /**
      * Count clients whose cif_number begins with the given prefix. Used by the CIF number generator
      * (TTYYYYNNNNNN format) to compute the next sequence within a given (type, year) bucket.

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientRiskRule.java

@@ -0,0 +1,173 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.math.BigDecimal;
+import org.apache.fineract.infrastructure.codes.domain.CodeValue;
+
+@Entity
+@Table(name = "m_client_risk_rule")
+public class ClientRiskRule {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "rule_name", nullable = false, length = 100)
+    private String ruleName;
+
+    @Column(name = "legal_form_id")
+    private Integer legalFormId;
+
+    @ManyToOne
+    @JoinColumn(name = "occupation_category_cv_id")
+    private CodeValue occupationCategory;
+
+    @ManyToOne
+    @JoinColumn(name = "occupation_cv_id")
+    private CodeValue occupation;
+
+    @Column(name = "min_monthly_income", precision = 19, scale = 6)
+    private BigDecimal minMonthlyIncome;
+
+    @Column(name = "max_monthly_income", precision = 19, scale = 6)
+    private BigDecimal maxMonthlyIncome;
+
+    @Column(name = "min_annual_income", precision = 19, scale = 6)
+    private BigDecimal minAnnualIncome;
+
+    @Column(name = "max_annual_income", precision = 19, scale = 6)
+    private BigDecimal maxAnnualIncome;
+
+    @Column(name = "min_annual_turnover", precision = 19, scale = 6)
+    private BigDecimal minAnnualTurnover;
+
+    @Column(name = "max_annual_turnover", precision = 19, scale = 6)
+    private BigDecimal maxAnnualTurnover;
+
+    @Column(name = "risk_category", nullable = false)
+    private Integer riskCategory;
+
+    @Column(name = "reason", nullable = false, length = 500)
+    private String reason;
+
+    @Column(name = "aml_check_status", length = 20)
+    private String amlCheckStatus;
+
+    @Column(name = "banned_entity_match", length = 10)
+    private String bannedEntityMatch;
+
+    @Column(name = "willful_defaulter", length = 10)
+    private String willfulDefaulter;
+
+    @Column(name = "ecgc_sal_flag", length = 10)
+    private String ecgcSalFlag;
+
+    @Column(name = "dormant_flag", length = 20)
+    private String dormantFlag;
+
+    @Column(name = "order_position", nullable = false)
+    private Integer orderPosition;
+
+    protected ClientRiskRule() {}
+
+    public Long getId() {
+        return id;
+    }
+
+    public String getRuleName() {
+        return ruleName;
+    }
+
+    public Integer getLegalFormId() {
+        return legalFormId;
+    }
+
+    public CodeValue getOccupationCategory() {
+        return occupationCategory;
+    }
+
+    public CodeValue getOccupation() {
+        return occupation;
+    }
+
+    public BigDecimal getMinMonthlyIncome() {
+        return minMonthlyIncome;
+    }
+
+    public BigDecimal getMaxMonthlyIncome() {
+        return maxMonthlyIncome;
+    }
+
+    public BigDecimal getMinAnnualIncome() {
+        return minAnnualIncome;
+    }
+
+    public BigDecimal getMaxAnnualIncome() {
+        return maxAnnualIncome;
+    }
+
+    public BigDecimal getMinAnnualTurnover() {
+        return minAnnualTurnover;
+    }
+
+    public BigDecimal getMaxAnnualTurnover() {
+        return maxAnnualTurnover;
+    }
+
+    public Integer getRiskCategory() {
+        return riskCategory;
+    }
+
+    public String getReason() {
+        return reason;
+    }
+
+    public Integer getOrderPosition() {
+        return orderPosition;
+    }
+
+    public String getAmlCheckStatus() {
+        return amlCheckStatus;
+    }
+
+    public String getBannedEntityMatch() {
+        return bannedEntityMatch;
+    }
+
+    public String getWillfulDefaulter() {
+        return willfulDefaulter;
+    }
+
+    public String getEcgcSalFlag() {
+        return ecgcSalFlag;
+    }
+
+    public String getDormantFlag() {
+        return dormantFlag;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientRiskRuleRepository.java

@@ -0,0 +1,29 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.domain;
+
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+
+public interface ClientRiskRuleRepository extends JpaRepository<ClientRiskRule, Long> {
+
+    @Query("SELECT r FROM ClientRiskRule r ORDER BY r.orderPosition ASC")
+    List<ClientRiskRule> findAllOrderedByOrderPosition();
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/mobilelookup/domain/MobileLookupLog.java

@@ -24,6 +24,7 @@ import jakarta.persistence.Table;
 import java.time.OffsetDateTime;
 import lombok.Getter;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * Activity log for each DIP / MNRL mobile number lookup request.
@@ -78,6 +79,6 @@ public class MobileLookupLog extends AbstractAuditableWithUTCDateTimeCustom<Long
         this.rawResponse = rawResponse;
         this.lookupSource = lookupSource;
         this.clientId = clientId;
-        this.lookedUpOn = OffsetDateTime.now();
+        this.lookedUpOn = DateUtils.getOffsetDateTimeOfTenant();
     }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/sanctions/domain/SanctionsEntryRepository.java

@@ -18,7 +18,9 @@
  */
 package org.apache.fineract.portfolio.sanctions.domain;
 
+import java.time.OffsetDateTime;
 import java.util.List;
+import java.util.Optional;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
@@ -40,4 +42,11 @@ public interface SanctionsEntryRepository extends JpaRepository<SanctionsEntry,
     void deleteAllByActiveTrue();
 
     long countByActiveTrue();
+
+    /**
+     * Timestamp the active sanctions list was last loaded into the database — i.e. the data
+     * currency shown to callers so they know which list snapshot a screening ran against.
+     */
+    @Query("SELECT MAX(s.createdDate) FROM SanctionsEntry s WHERE s.active = true")
+    Optional<OffsetDateTime> findListLastLoadedOn();
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/sanctions/domain/SanctionsScreeningLog.java

@@ -23,6 +23,7 @@ import jakarta.persistence.Entity;
 import jakarta.persistence.Table;
 import java.time.OffsetDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * Activity log for each sanctions screening request.
@@ -73,7 +74,7 @@ public class SanctionsScreeningLog extends AbstractAuditableWithUTCDateTimeCusto
         this.screeningSource = screeningSource;
         this.clientId = clientId;
         this.ipAddress = ipAddress;
-        this.screenedOn = OffsetDateTime.now();
+        this.screenedOn = DateUtils.getOffsetDateTimeOfTenant();
     }
 
     // ── Accessors ─────────────────────────────────────────────────────────────

fineract-core/src/main/java/org/apache/fineract/portfolio/search/data/SearchConditions.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.search.data;
 
+import java.util.Locale;
 import org.apache.fineract.portfolio.search.SearchConstants.SearchSupportedResources;
 
 public class SearchConditions {
@@ -37,17 +38,17 @@ public class SearchConditions {
         this.searchResource = searchResource;
         this.exactMatch = exactMatch;
         this.clientSearch = null == searchResource
-                || searchResource.toLowerCase().contains(SearchSupportedResources.CLIENTS.name().toLowerCase());
+                || searchResource.toLowerCase(Locale.ROOT).contains(SearchSupportedResources.CLIENTS.name().toLowerCase(Locale.ROOT));
         this.groupSearch = null == searchResource
-                || searchResource.toLowerCase().contains(SearchSupportedResources.GROUPS.name().toLowerCase());
+                || searchResource.toLowerCase(Locale.ROOT).contains(SearchSupportedResources.GROUPS.name().toLowerCase(Locale.ROOT));
         this.loanSeach = null == searchResource
-                || searchResource.toLowerCase().contains(SearchSupportedResources.LOANS.name().toLowerCase());
+                || searchResource.toLowerCase(Locale.ROOT).contains(SearchSupportedResources.LOANS.name().toLowerCase(Locale.ROOT));
         this.savingSeach = null == searchResource
-                || searchResource.toLowerCase().contains(SearchSupportedResources.SAVINGS.name().toLowerCase());
+                || searchResource.toLowerCase(Locale.ROOT).contains(SearchSupportedResources.SAVINGS.name().toLowerCase(Locale.ROOT));
         this.shareSeach = null == searchResource
-                || searchResource.toLowerCase().contains(SearchSupportedResources.SHARES.name().toLowerCase());
+                || searchResource.toLowerCase(Locale.ROOT).contains(SearchSupportedResources.SHARES.name().toLowerCase(Locale.ROOT));
         this.clientIdentifierSearch = null == searchResource
-                || searchResource.toLowerCase().contains(SearchSupportedResources.CLIENTIDENTIFIERS.name().toLowerCase());
+                || searchResource.toLowerCase(Locale.ROOT).contains(SearchSupportedResources.CLIENTIDENTIFIERS.name().toLowerCase(Locale.ROOT));
     }
 
     public SearchConditions(final String searchQueryParam, final String searchResource, final Boolean clientSearch,

fineract-core/src/main/java/org/apache/fineract/portfolio/search/service/SearchUtil.java

@@ -321,6 +321,6 @@ public class SearchUtil {
 
     public String camelToSnake(final String camelStr) {
         return camelStr == null ? null
-                : camelStr.replaceAll("([A-Z]+)([A-Z][a-z])", "$1_$2").replaceAll("([a-z])([A-Z])", "$1_$2").toLowerCase();
+                : camelStr.replaceAll("([A-Z]+)([A-Z][a-z])", "$1_$2").replaceAll("([a-z])([A-Z])", "$1_$2").toLowerCase(Locale.ROOT);
     }
 }

fineract-core/src/main/java/org/apache/fineract/useradministration/agreement/domain/UserAgreement.java

@@ -0,0 +1,92 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.agreement.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.FetchType;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.PrePersist;
+import jakarta.persistence.Table;
+import jakarta.persistence.UniqueConstraint;
+import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+import org.apache.fineract.useradministration.domain.AppUser;
+
+/**
+ * A versioned, admin-manageable "user agreement" (bank policy/warning) that every user must accept right after
+ * logging in. Only one row may be {@link #active} at a time; enforced transactionally by the write service, not a
+ * DB constraint.
+ */
+@Entity
+@Table(name = "m_user_agreement", uniqueConstraints = { @UniqueConstraint(columnNames = "version", name = "uq_user_agreement_version") })
+@Getter
+@Setter
+@NoArgsConstructor
+public class UserAgreement extends AbstractPersistableCustom<Long> {
+
+    @Column(name = "version", nullable = false)
+    private Integer version;
+
+    @Column(name = "title", length = 200, nullable = false)
+    private String title;
+
+    @Column(name = "body", nullable = false)
+    private String body;
+
+    @Column(name = "is_active", nullable = false)
+    private boolean active;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "created_by", nullable = false)
+    private AppUser createdBy;
+
+    @Column(name = "created_on", nullable = false, updatable = false)
+    private OffsetDateTime createdOn;
+
+    @PrePersist
+    private void prePersist() {
+        if (createdOn == null) {
+            createdOn = OffsetDateTime.now(ZoneOffset.UTC);
+        }
+    }
+
+    public static UserAgreement create(final Integer version, final String title, final String body, final AppUser createdBy) {
+        final UserAgreement agreement = new UserAgreement();
+        agreement.version = version;
+        agreement.title = title;
+        agreement.body = body;
+        agreement.createdBy = createdBy;
+        agreement.active = true;
+        return agreement;
+    }
+
+    public void activate() {
+        this.active = true;
+    }
+
+    public void deactivate() {
+        this.active = false;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/useradministration/agreement/domain/UserAgreementAcceptance.java

@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.agreement.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.FetchType;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.PrePersist;
+import jakarta.persistence.Table;
+import jakarta.persistence.UniqueConstraint;
+import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+import org.apache.fineract.useradministration.domain.AppUser;
+
+/**
+ * Audit-proof record of a user accepting a given version of the {@link UserAgreement} right after logging in.
+ * {@link #agreementVersion} is a denormalized snapshot of {@code UserAgreement.version} at acceptance time, so the
+ * acceptance record survives future version bumps unaffected.
+ */
+@Entity
+@Table(name = "m_user_agreement_acceptance", uniqueConstraints = {
+        @UniqueConstraint(columnNames = { "appuser_id", "agreement_id" }, name = "uq_user_agreement_acceptance") })
+@Getter
+@Setter
+@NoArgsConstructor
+public class UserAgreementAcceptance extends AbstractPersistableCustom<Long> {
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "appuser_id", nullable = false)
+    private AppUser appUser;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "agreement_id", nullable = false)
+    private UserAgreement agreement;
+
+    @Column(name = "agreement_version", nullable = false)
+    private Integer agreementVersion;
+
+    @Column(name = "accepted_on", nullable = false, updatable = false)
+    private OffsetDateTime acceptedOn;
+
+    @Column(name = "ip_address", length = 45)
+    private String ipAddress;
+
+    @Column(name = "user_agent", length = 500)
+    private String userAgent;
+
+    @PrePersist
+    private void prePersist() {
+        if (acceptedOn == null) {
+            acceptedOn = OffsetDateTime.now(ZoneOffset.UTC);
+        }
+    }
+
+    public static UserAgreementAcceptance create(final AppUser appUser, final UserAgreement agreement, final String ipAddress,
+            final String userAgent) {
+        final UserAgreementAcceptance acceptance = new UserAgreementAcceptance();
+        acceptance.appUser = appUser;
+        acceptance.agreement = agreement;
+        acceptance.agreementVersion = agreement.getVersion();
+        acceptance.ipAddress = ipAddress;
+        acceptance.userAgent = userAgent;
+        return acceptance;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/useradministration/agreement/domain/UserAgreementAcceptanceRepository.java

@@ -0,0 +1,26 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.agreement.domain;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface UserAgreementAcceptanceRepository extends JpaRepository<UserAgreementAcceptance, Long> {
+
+    boolean existsByAppUser_IdAndAgreement_Id(Long appUserId, Long agreementId);
+}

fineract-core/src/main/java/org/apache/fineract/useradministration/agreement/domain/UserAgreementRepository.java

@@ -0,0 +1,30 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.agreement.domain;
+
+import java.util.List;
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface UserAgreementRepository extends JpaRepository<UserAgreement, Long> {
+
+    Optional<UserAgreement> findByActiveTrue();
+
+    List<UserAgreement> findAllByOrderByVersionDesc();
+}

fineract-core/src/main/java/org/apache/fineract/useradministration/dsc/domain/BankUserDscRepository.java

@@ -39,7 +39,7 @@ public interface BankUserDscRepository extends JpaRepository<BankUserDsc, Long>
 
     /**
      * Login gate: returns true if the user has at least one usable DSC mapping that's also not
-     * past its notAfter date. The {@code dscExpiryDate &gt;= today} clause prevents 2FA-gating a
+     * past its notAfter date. The {@code dscExpiryDate >= today} clause prevents 2FA-gating a
      * user who's enrolled but whose cert silently expired between log-ins — they'd otherwise be
      * stuck in a verification loop with a cert the helper would sign with but the server would
      * accept (the verify side filters too, but the gate is what kicks the user into the DSC flow

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/domain/CurrentAccountPendingEdit.java

@@ -29,6 +29,7 @@ import java.time.LocalDateTime;
 import lombok.Getter;
 import lombok.Setter;
 import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 import org.apache.fineract.useradministration.domain.AppUser;
 
 /**
@@ -452,7 +453,7 @@ public class CurrentAccountPendingEdit extends AbstractPersistableCustom<Long> {
     public CurrentAccountPendingEdit(final CurrentAccount currentAccount, final AppUser maker) {
         this.currentAccount = currentAccount;
         this.maker = maker;
-        this.createdOn = LocalDateTime.now();
+        this.createdOn = DateUtils.getLocalDateTimeOfTenant();
         this.status = STATUS_PENDING;
         this.pendingLockKey = lockKeyFor(currentAccount.getId());
     }
@@ -582,14 +583,14 @@ public class CurrentAccountPendingEdit extends AbstractPersistableCustom<Long> {
     public void markApproved(final AppUser checker) {
         this.status = STATUS_APPROVED;
         this.checker = checker;
-        this.checkedOn = LocalDateTime.now();
+        this.checkedOn = DateUtils.getLocalDateTimeOfTenant();
         this.pendingLockKey = null;
     }
 
     public void markRejected(final AppUser checker, final String reason) {
         this.status = STATUS_REJECTED;
         this.checker = checker;
-        this.checkedOn = LocalDateTime.now();
+        this.checkedOn = DateUtils.getLocalDateTimeOfTenant();
         this.rejectReason = reason;
         this.pendingLockKey = null;
     }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/domain/CurrentAccountRepositoryWrapper.java

@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.currentaccount.domain;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.portfolio.currentaccount.exception.CurrentAccountNotFoundException;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * <p>
+ * Wrapper for {@link CurrentAccountRepository} that is responsible for checking if {@link CurrentAccount} is
+ * returned when using <code>findOne</code> repository method and throwing an appropriate not found exception.
+ * </p>
+ *
+ * <p>
+ * This is to avoid need for checking and throwing in multiple areas of code base where
+ * {@link CurrentAccountRepository} is required.
+ * </p>
+ */
+@Service
+@RequiredArgsConstructor
+public class CurrentAccountRepositoryWrapper {
+
+    private final CurrentAccountRepository repository;
+
+    @Transactional(readOnly = true)
+    public CurrentAccount findOneWithNotFoundDetection(final Long id) {
+        return this.repository.findById(id).orElseThrow(() -> new CurrentAccountNotFoundException(id));
+    }
+}

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/service/CurrentAccountNumberGenerator.java

@@ -51,7 +51,9 @@ public class CurrentAccountNumberGenerator {
                     if (val > maxVal) {
                         maxVal = val;
                     }
-                } catch (NumberFormatException ignored) {}
+                } catch (NumberFormatException ignored) {
+                    // non-numeric suffix - skip when computing the max existing sequence
+                }
             }
         }
 

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/service/CurrentAccountReadPlatformService.java

@@ -26,6 +26,8 @@ public interface CurrentAccountReadPlatformService {
 
     Map<String, Object> retrieveOne(Long accountId);
 
+    Map<String, Object> retrieveOneTransaction(Long accountId, Long transactionId);
+
     List<Map<String, Object>> retrieveAll();
 
     List<Map<String, Object>> retrieveAll(Integer offset, Integer limit, String accountNo, String clientName);

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/data/CurrentProductDataValidator.java

@@ -54,7 +54,6 @@ import com.google.gson.JsonElement;
 import com.google.gson.reflect.TypeToken;
 import java.lang.reflect.Type;
 import java.math.BigDecimal;
-import java.time.MonthDay;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -76,7 +75,6 @@ import org.apache.fineract.portfolio.savings.DepositAccountType;
 import org.apache.fineract.portfolio.savings.SavingsApiConstants;
 import org.apache.fineract.portfolio.savings.SavingsCompoundingInterestPeriodType;
 import org.apache.fineract.portfolio.savings.SavingsInterestCalculationDaysInYearType;
-import org.apache.fineract.portfolio.savings.SavingsInterestCalculationType;
 import org.apache.fineract.portfolio.savings.SavingsPostingInterestPeriodType;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProduct;
 import org.apache.fineract.portfolio.savings.data.SavingsProductAccountingDataValidator;

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/domain/CurrentProduct.java

@@ -56,18 +56,11 @@ import static org.apache.fineract.portfolio.savings.SavingsApiConstants.accountT
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.customerSegmentParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.productCodeParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.glAccountIdParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.effectiveDateParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.effectiveToParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.endDateParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.introducerRequiredParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.shareLinkingEnabledParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.nominationFacilityParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.dormancyAlertParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.interestCalculateSelectorParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.averagePeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.autoPostParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.frequencyFixDayParamName;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.lastInterestDateParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.enableLockinPeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.balanceSwapOptionParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.msmeParamName;

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/domain/CurrentProductDepositLimitKyc.java

@@ -26,6 +26,7 @@ import jakarta.persistence.OneToOne;
 import jakarta.persistence.Table;
 import java.time.LocalDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Entity
 @Table(name = "m_current_product_deposit_limit_kyc")
@@ -57,12 +58,12 @@ public class CurrentProductDepositLimitKyc extends AbstractPersistableCustom<Lon
     private LocalDateTime createdDate;
 
     protected CurrentProductDepositLimitKyc() {
-        this.createdDate = LocalDateTime.now();
     }
 
     public CurrentProductDepositLimitKyc(CurrentProduct currentProduct) {
         this();
         this.currentProduct = currentProduct;
+        this.createdDate = DateUtils.getLocalDateTimeOfTenant();
     }
 
     public CurrentProduct getCurrentProduct() { return currentProduct; }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/domain/CurrentProductFacilityConfig.java

@@ -26,6 +26,7 @@ import jakarta.persistence.OneToOne;
 import jakarta.persistence.Table;
 import java.time.LocalDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Entity
 @Table(name = "m_current_product_facility_config")
@@ -87,12 +88,12 @@ public class CurrentProductFacilityConfig extends AbstractPersistableCustom<Long
     private LocalDateTime createdDate;
 
     protected CurrentProductFacilityConfig() {
-        this.createdDate = LocalDateTime.now();
     }
 
     public CurrentProductFacilityConfig(CurrentProduct currentProduct) {
         this();
         this.currentProduct = currentProduct;
+        this.createdDate = DateUtils.getLocalDateTimeOfTenant();
     }
 
     public CurrentProduct getCurrentProduct() { return currentProduct; }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/domain/CurrentProductFacilityLimit.java

@@ -26,6 +26,7 @@ import jakarta.persistence.ManyToOne;
 import jakarta.persistence.Table;
 import java.time.LocalDateTime;
 import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Entity
 @Table(name = "m_current_product_facility_limits")
@@ -51,7 +52,6 @@ public class CurrentProductFacilityLimit extends AbstractPersistableCustom<Long>
     private LocalDateTime createdDate;
 
     protected CurrentProductFacilityLimit() {
-        this.createdDate = LocalDateTime.now();
     }
 
     private CurrentProductFacilityLimit(CurrentProduct currentProduct, String limitType,
@@ -62,6 +62,7 @@ public class CurrentProductFacilityLimit extends AbstractPersistableCustom<Long>
         this.generalLimit = generalLimit;
         this.minorAccountLimit = minorAccountLimit;
         this.smallSavingLimit = smallSavingLimit;
+        this.createdDate = DateUtils.getLocalDateTimeOfTenant();
     }
 
     public static CurrentProductFacilityLimit create(CurrentProduct currentProduct, String limitType,

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductReadPlatformServiceImpl.java

@@ -19,13 +19,11 @@
 package org.apache.fineract.portfolio.currentproduct.service;
 
 import com.google.gson.Gson;
-import com.google.gson.JsonObject;
 import com.google.gson.reflect.TypeToken;
 import java.lang.reflect.Type;
 import java.math.BigDecimal;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;

fineract-document/src/main/java/org/apache/fineract/infrastructure/contentstore/service/FileContentStoreService.java

@@ -95,23 +95,24 @@ public class FileContentStoreService implements ContentStoreService {
 
         final var target = Files.exists(getPath(safePath, false)) ? getPath(safePath, false) : getPath(safePath, true);
 
-        try (var in = is) {
-            IOUtils.copy(in, new FileOutputStream(target.toString()));
+        try (var in = is; var out = new FileOutputStream(target.toString())) {
+            IOUtils.copy(in, out);
         } catch (Exception e) {
             throw new ContentStoreException(e);
         }
 
         final var relativePath = getRelativePath(target);
 
-        try {
-            postUploadContentPolicy
-                    .check(ContentPolicyContext.builder().path(path).inputStream(getInputStream(target)).mimeType(mimeType).build());
+        try (var in = getInputStream(target)) {
+            postUploadContentPolicy.check(ContentPolicyContext.builder().path(path).inputStream(in).mimeType(mimeType).build());
         } catch (ContentPolicyException e) {
             log.warn("Delete file because it didn't comply with the post-upload policy check: {} - {}", target, e.getMessage());
 
             delete(relativePath.toString());
 
             throw e;
+        } catch (IOException e) {
+            throw new ContentStoreException(e);
         }
 
         return relativePath.toString();

fineract-document/src/main/java/org/apache/fineract/infrastructure/documentmanagement/service/DocumentWritePlatformServiceImpl.java

@@ -21,6 +21,7 @@ package org.apache.fineract.infrastructure.documentmanagement.service;
 import static java.util.Objects.requireNonNull;
 
 import jakarta.validation.Valid;
+import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
 import lombok.RequiredArgsConstructor;
@@ -31,6 +32,7 @@ import org.apache.commons.lang3.Strings;
 import org.apache.fineract.infrastructure.contentstore.service.ContentStoreService;
 import org.apache.fineract.infrastructure.core.config.FineractProperties;
 import org.apache.fineract.infrastructure.core.exception.ErrorHandler;
+import org.apache.fineract.infrastructure.documentmanagement.adapter.EntitySignatureIdAdapter;
 import org.apache.fineract.infrastructure.documentmanagement.data.DocumentCreateRequest;
 import org.apache.fineract.infrastructure.documentmanagement.data.DocumentCreateResponse;
 import org.apache.fineract.infrastructure.documentmanagement.data.DocumentDeleteRequest;
@@ -59,6 +61,7 @@ public class DocumentWritePlatformServiceImpl implements DocumentWritePlatformSe
     private final ContentStoreService storeService;
     private final BusinessEventNotifierService businessEventNotifierService;
     private final FineractProperties properties;
+    private final List<EntitySignatureIdAdapter> signatureIdAdapters;
 
     @Transactional
     @Override
@@ -74,13 +77,30 @@ public class DocumentWritePlatformServiceImpl implements DocumentWritePlatformSe
 
             path = storeService.upload(path, request.getStream(), request.getType());
 
-            final var doc = new Document().setParentEntityType(request.getEntityType()).setParentEntityId(request.getEntityId())
-                    .setName(Optional.ofNullable(request.getName()).orElse(request.getFileName())).setFileName(request.getFileName())
-                    .setSize(request.getSize()).setType(request.getType()).setDescription(request.getDescription()).setLocation(path)
-                    .setStorageType(storeService.getType().getValue());
+            final var docName = Optional.ofNullable(request.getName()).orElse(request.getFileName());
+
+            // Some document "slots" (e.g. a client's signature) are single-slot, mirroring
+            // m_client.image_id: re-upload should replace the existing row in place rather than
+            // leave the old one behind as an orphan whose ordering readers then disagree about.
+            // Adapters recognize their own (entityType, name) convention and own the pointer.
+            final var signatureAdapter = signatureIdAdapters.stream()
+                    .filter(adapter -> adapter.accept(request.getEntityType(), docName)).findFirst();
+
+            final var doc = signatureAdapter.flatMap(adapter -> adapter.get(request.getEntityId()))
+                    .flatMap(result -> documentRepository.findById(result.getId())).map(existing -> {
+                        // replacing an existing single-slot document: drop the old file, reuse the row
+                        storeService.delete(existing.getLocation());
+                        return existing;
+                    }).orElseGet(Document::new);
+
+            doc.setParentEntityType(request.getEntityType()).setParentEntityId(request.getEntityId()).setName(docName)
+                    .setFileName(request.getFileName()).setSize(request.getSize()).setType(request.getType())
+                    .setDescription(request.getDescription()).setLocation(path).setStorageType(storeService.getType().getValue());
 
             documentRepository.save(doc);
 
+            signatureAdapter.ifPresent(adapter -> adapter.set(request.getEntityId(), doc.getId()));
+
             businessEventNotifierService.notifyPostBusinessEvent(new DocumentCreatedBusinessEvent(documentMapper.map(doc)));
 
             return DocumentCreateResponse.builder().resourceId(doc.getId()).resourceIdentifier(request.getEntityType()).build();

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/api/JournalEntriesApiResource.java

@@ -75,7 +75,7 @@ import org.springframework.stereotype.Component;
 @Path("/v1/journalentries")
 @Component
 @Tag(name = "Journal Entries", description = """
-        A journal entry refers to the logging of transactions against general ledger accounts. A journal entry may consist of several line items, each of which is either a "debit" or a "credit". The total amount of the debits must equal the total amount of the credits or the journal entry is said to be "unbalanced"\s
+        A journal entry refers to the logging of transactions against general ledger accounts. A journal entry may consist of several line items, each of which is either a "debit" or a "credit". The total amount of the debits must equal the total amount of the credits or the journal entry is said to be "unbalanced"
 
         A journal entry directly changes the account balances on the general ledger""")
 @RequiredArgsConstructor

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java

@@ -146,11 +146,18 @@ public class SecurityConfig {
             auth.requestMatchers(API_MATCHER.matcher(HttpMethod.OPTIONS, "/api/**")).permitAll()
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/echo")).permitAll()
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/authentication")).permitAll()
+                    // Meeting vote public endpoints — secured by UUID token in the URL path
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/public/meeting-vote/**")).permitAll()
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/public/meeting-vote/**")).permitAll()
                     // IMPS receiver — Fineract acts as the bank-side endpoint under
                     // IMPS_BANK_API_SPEC_CBS_1.0 §6.2.x. LincPay (the switch) calls these without
                     // a Fineract Bearer token; security is enforced at the JWT envelope
                     // (signature + encryption) by ImpsJwtUtil / ImpsCryptoUtil inside the handler.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/imps/**")).permitAll()
+                    // NPCI clearing-house receiver — the real, separate NPCI service pushes routed
+                    // packages here without a Fineract Bearer token; security is enforced by the
+                    // envelope's RSA signature/encryption (NpciCryptoUtil) inside the handler.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/npci/**")).permitAll()
                     // Login OTP — same posture as PAN/GSTIN public verification: provider-credentialed,
                     // no Fineract auth required.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/login/otp/generate")).permitAll()

fineract-provider/src/main/java/org/apache/fineract/infrastructure/email/service/EmailTemplateServiceImpl.java

@@ -21,6 +21,7 @@ package org.apache.fineract.infrastructure.email.service;
 import java.time.Year;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Service
 public class EmailTemplateServiceImpl implements EmailTemplateService {
@@ -129,7 +130,7 @@ public class EmailTemplateServiceImpl implements EmailTemplateService {
                 + escape(supportEmail) + "</a>"
                 + "          </p>"
                 + "          <p style=\"margin:0;font-size:12px;color:#94a3b8;\">"
-                + "            &copy; " + Year.now().getValue() + " " + escape(brandName) + ". All rights reserved."
+                + "            &copy; " + Year.now(DateUtils.getDateTimeZoneOfTenant()).getValue() + " " + escape(brandName) + ". All rights reserved."
                 + "          </p>"
                 + "        </td></tr>"
                 + "      </table>"

fineract-provider/src/main/java/org/apache/fineract/infrastructure/imps/crypto/ImpsCryptoUtil.java

@@ -109,6 +109,7 @@ public class ImpsCryptoUtil {
     }
 
     /** Decrypt inbound payload using the CBS private key. */
+    @SuppressWarnings("StringSplitter")
     public String decryptJson(String encryptedPayload) {
         if (cbsPrivateKey == null) {
             throw new IllegalStateException("CBS private key not loaded — check fineract.imps.cbs.private-key-path");

fineract-provider/src/main/java/org/apache/fineract/infrastructure/imps/service/ImpsCbsServiceImpl.java

@@ -34,6 +34,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 /**
  * STUB implementation — returns hard-coded SUCCESS for every request and
@@ -108,7 +109,7 @@ public class ImpsCbsServiceImpl implements ImpsCbsService {
         resp.setRefId(request.getRefId());
         resp.setUtr(request.getUtr());
         resp.setAmount(request.getAmount());
-        resp.setTimeStamp(OffsetDateTime.now().format(ISO_OFFSET));
+        resp.setTimeStamp(OffsetDateTime.now(DateUtils.getDateTimeZoneOfTenant()).format(ISO_OFFSET));
         resp.setStatus("SUCCESS");
         resp.setResponseCode("00");
         AccountData payeeAcc = Optional.ofNullable(request.getPayee()).map(PartyData::getAccount).orElse(null);

fineract-provider/src/main/java/org/apache/fineract/infrastructure/openproject/service/OpenProjectService.java

@@ -28,7 +28,6 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.LinkedHashMap;
 import java.util.Map;
-import java.util.concurrent.TimeUnit;
 import lombok.extern.slf4j.Slf4j;
 import okhttp3.Credentials;
 import okhttp3.MediaType;
@@ -42,6 +41,7 @@ import org.apache.fineract.infrastructure.openproject.data.OpenProjectProjectDat
 import org.apache.fineract.infrastructure.openproject.data.OpenProjectStatusSummaryData;
 import org.apache.fineract.infrastructure.openproject.data.OpenProjectWorkPackageData;
 import org.springframework.stereotype.Service;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Service
 @Slf4j
@@ -164,7 +164,7 @@ public class OpenProjectService {
         }
 
         // Set required custom field: "Last Follow-up Date" (customField8)
-        body.addProperty("customField8", LocalDate.now().toString());
+        body.addProperty("customField8", LocalDate.now(DateUtils.getDateTimeZoneOfTenant()).toString());
 
         if (typeName != null && !typeName.isBlank()) {
             JsonObject links = new JsonObject();

fineract-provider/src/main/java/org/apache/fineract/infrastructure/rbifeed/service/RbiFeedFetchService.java

@@ -47,6 +47,7 @@ import org.springframework.transaction.annotation.Transactional;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Service
 @RequiredArgsConstructor
@@ -127,7 +128,7 @@ public class RbiFeedFetchService {
         NodeList items = doc.getElementsByTagName("item");
         log.debug("RBI FeedFetchService - Parsed {} items from RSS for category: {}", items.getLength(), category);
         List<RbiFeedItem> newItems = new ArrayList<>();
-        LocalDateTime now = LocalDateTime.now();
+        LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
 
         for (int i = 0; i < items.getLength(); i++) {
             Element item = (Element) items.item(i);

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/otp/api/EmailLoginOtpApiResource.java

@@ -18,6 +18,8 @@
  */
 package org.apache.fineract.infrastructure.security.otp.api;
 
+import com.google.common.base.Splitter;
+import com.google.common.collect.Iterables;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
 import io.swagger.v3.oas.annotations.Operation;
@@ -107,7 +109,7 @@ public class EmailLoginOtpApiResource {
         }
         final String fwd = req.getHeader("X-Forwarded-For");
         if (fwd != null && !fwd.isBlank()) {
-            return fwd.split(",")[0].trim();
+            return Iterables.get(Splitter.on(',').split(fwd), 0).trim();
         }
         return req.getRemoteAddr();
     }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/otp/api/LoginOtpApiResource.java

@@ -18,6 +18,8 @@
  */
 package org.apache.fineract.infrastructure.security.otp.api;
 
+import com.google.common.base.Splitter;
+import com.google.common.collect.Iterables;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
 import io.swagger.v3.oas.annotations.Operation;
@@ -107,7 +109,7 @@ public class LoginOtpApiResource {
         }
         final String fwd = req.getHeader("X-Forwarded-For");
         if (fwd != null && !fwd.isBlank()) {
-            return fwd.split(",")[0].trim();
+            return Iterables.get(Splitter.on(',').split(fwd), 0).trim();
         }
         return req.getRemoteAddr();
     }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/otp/service/EmailLoginOtpServiceImpl.java

@@ -33,6 +33,7 @@ import org.apache.fineract.infrastructure.security.otp.data.OtpGenerateResponse;
 import org.apache.fineract.infrastructure.security.otp.data.OtpVerifyResponse;
 import org.apache.fineract.infrastructure.security.otp.domain.OtpLog;
 import org.apache.fineract.infrastructure.security.otp.domain.OtpLogRepository;
+import org.apache.fineract.infrastructure.security.otp.util.OtpDestinationMasker;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.apache.fineract.useradministration.domain.AppUserRepository;
 import org.apache.fineract.useradministration.mfa.domain.MfaFactorType;
@@ -44,6 +45,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Service
 public class EmailLoginOtpServiceImpl implements EmailLoginOtpService {
@@ -127,17 +129,17 @@ public class EmailLoginOtpServiceImpl implements EmailLoginOtpService {
 
         // Render the branded template — same look and feel for OTP, welcome, password-reset, alerts.
         final String html = emailTemplateService.renderOtp(recipientName, otp, validityMinutes);
-        final String subject = "Your OTP for Login - " + appName + " (" + LocalDateTime.now().format(SUBJECT_TIMESTAMP) + ")";
+        final String subject = "Your OTP for Login - " + appName + " (" + LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant()).format(SUBJECT_TIMESTAMP) + ")";
 
         final boolean sent = emailSenderService.sendHtml(email, subject, html);
         if (sent) {
             log.setStatus(STATUS_SENT);
             final OtpLog saved = otpLogRepository.saveAndFlush(log);
-            LOG.info("Email login OTP sent. otpId={}, user={}, email={}", saved.getId(), username, mask(email));
+            LOG.info("Email login OTP sent. otpId={}, user={}, email={}", saved.getId(), username, OtpDestinationMasker.maskEmail(email));
             return OtpGenerateResponse.builder()
                     .success(true)
                     .otpId(saved.getId())
-                    .maskedMobile(mask(email))      // reusing the field; UI just shows where it was sent
+                    .maskedMobile(OtpDestinationMasker.maskEmail(email))      // reusing the field; UI just shows where it was sent
                     .expiresInSeconds(ttlSeconds)
                     .message("OTP sent to your registered email")
                     .build();
@@ -240,19 +242,6 @@ public class EmailLoginOtpServiceImpl implements EmailLoginOtpService {
         }
     }
 
-    private String mask(final String email) {
-        if (email == null || !email.contains("@")) {
-            return "****";
-        }
-        final int at = email.indexOf('@');
-        final String local = email.substring(0, at);
-        final String domain = email.substring(at);
-        if (local.length() <= 2) {
-            return "*" + local.substring(local.length() - 1) + domain;
-        }
-        return local.charAt(0) + "***" + local.charAt(local.length() - 1) + domain;
-    }
-
     private String displayName(final AppUser user) {
         if (user.getFirstname() != null && !user.getFirstname().isBlank()) {
             return user.getFirstname();

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/otp/service/LoginOtpServiceImpl.java

@@ -31,6 +31,7 @@ import org.apache.fineract.infrastructure.security.otp.data.OtpGenerateResponse;
 import org.apache.fineract.infrastructure.security.otp.data.OtpVerifyResponse;
 import org.apache.fineract.infrastructure.security.otp.domain.OtpLog;
 import org.apache.fineract.infrastructure.security.otp.domain.OtpLogRepository;
+import org.apache.fineract.infrastructure.security.otp.util.OtpDestinationMasker;
 import org.apache.fineract.useradministration.domain.AppUser;
 import org.apache.fineract.useradministration.domain.AppUserRepository;
 import org.apache.fineract.useradministration.mfa.domain.MfaFactorType;
@@ -156,12 +157,12 @@ public class LoginOtpServiceImpl implements LoginOtpService {
                 log.setOtpReference(extractField(response, "reference_id", "refNumber", "ref_number",
                         "transactionId", "txnId", "requestId"));
                 final OtpLog saved = otpLogRepository.saveAndFlush(log);
-                LOG.info("LincPay login OTP sent. otpId={}, mobile={}", saved.getId(), mask(mobileNumber));
+                LOG.info("LincPay login OTP sent. otpId={}, mobile={}", saved.getId(), OtpDestinationMasker.maskMobile(mobileNumber));
                 return OtpGenerateResponse.builder()
                         .success(true)
                         .otpId(saved.getId())
                         .otpReference(saved.getOtpReference())
-                        .maskedMobile(mask(mobileNumber))
+                        .maskedMobile(OtpDestinationMasker.maskMobile(mobileNumber))
                         .expiresInSeconds(ttlSeconds)
                         .message("OTP sent")
                         .build();
@@ -239,7 +240,7 @@ public class LoginOtpServiceImpl implements LoginOtpService {
                 row.setVerifiedAt(OffsetDateTime.now(ZoneOffset.UTC));
                 otpLogRepository.saveAndFlush(row);
                 autoPromoteFactor(row);
-                LOG.info("LincPay login OTP verified. otpId={}, mobile={}", row.getId(), mask(row.getMobileNumber()));
+                LOG.info("LincPay login OTP verified. otpId={}, mobile={}", row.getId(), OtpDestinationMasker.maskMobile(row.getMobileNumber()));
                 return OtpVerifyResponse.builder().verified(true).message("OTP verified").build();
             }
 
@@ -364,13 +365,6 @@ public class LoginOtpServiceImpl implements LoginOtpService {
         }
     }
 
-    private String mask(final String mobile) {
-        if (mobile == null || mobile.length() < 4) {
-            return "****";
-        }
-        return "******" + mobile.substring(mobile.length() - 4);
-    }
-
     private String truncate(final String s, final int max) {
         if (s == null) {
             return null;

fineract-provider/src/main/java/org/apache/fineract/organisation/teller/service/TellerWritePlatformServiceJpaImpl.java

@@ -20,7 +20,6 @@ package org.apache.fineract.organisation.teller.service;
 
 import jakarta.persistence.PersistenceException;
 import java.util.Map;
-import java.util.Set;
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.exception.ExceptionUtils;
@@ -44,7 +43,6 @@ import org.apache.fineract.organisation.teller.domain.CashierTransactionReposito
 import org.apache.fineract.organisation.teller.domain.CashierTxnType;
 import org.apache.fineract.organisation.teller.domain.Teller;
 import org.apache.fineract.organisation.teller.domain.TellerRepositoryWrapper;
-import org.apache.fineract.organisation.teller.exception.CashierExistForTellerException;
 import org.apache.fineract.organisation.teller.exception.CashierNotFoundException;
 import org.apache.fineract.organisation.teller.exception.TellerAlreadyExistsException;
 import org.apache.fineract.organisation.teller.serialization.TellerCommandFromApiJsonDeserializer;

fineract-provider/src/main/java/org/apache/fineract/portfolio/accountdetails/data/GuarantorAccountSummaryData.java

@@ -19,6 +19,7 @@
 package org.apache.fineract.portfolio.accountdetails.data;
 
 import java.math.BigDecimal;
+import java.time.LocalDate;
 import org.apache.fineract.infrastructure.core.data.EnumOptionData;
 import org.apache.fineract.portfolio.loanaccount.data.LoanStatusEnumData;
 
@@ -44,12 +45,28 @@ public class GuarantorAccountSummaryData {
     private final Boolean isActive;
     private final String relationship;
     private final BigDecimal onHoldAmount;
+    private final String savingsAccountNo;
+    private final BigDecimal amountReleased;
+    private final String borrowerName;
+    private final BigDecimal totalOverdue;
+    private final LocalDate overdueSinceDate;
+    private final LocalDate submittedOnDate;
+    private final LocalDate approvedOnDate;
+    private final LocalDate disbursedOnDate;
+    private final LocalDate expectedMaturityDate;
+    private final BigDecimal amountRemaining;
+    private final BigDecimal savingsBalance;
+    private final Integer missedInstallments;
 
     public GuarantorAccountSummaryData(final Long id, final String accountNo, final String externalId, final Long productId,
             final String loanProductName, final String shortLoanProductName, final LoanStatusEnumData loanStatus,
             final EnumOptionData loanType, final Integer loanCycle, final Boolean inArrears, final BigDecimal originalLoan,
             final BigDecimal loanBalance, final BigDecimal amountPaid, final Boolean isActive, final String relationship,
-            final BigDecimal onHoldAmount) {
+            final BigDecimal onHoldAmount, final String savingsAccountNo, final BigDecimal amountReleased,
+            final String borrowerName, final BigDecimal totalOverdue, final LocalDate overdueSinceDate,
+            final LocalDate submittedOnDate, final LocalDate approvedOnDate, final LocalDate disbursedOnDate,
+            final LocalDate expectedMaturityDate, final BigDecimal amountRemaining, final BigDecimal savingsBalance,
+            final Integer missedInstallments) {
         this.id = id;
         this.accountNo = accountNo;
         this.externalId = externalId;
@@ -66,5 +83,17 @@ public class GuarantorAccountSummaryData {
         this.isActive = isActive;
         this.relationship = relationship;
         this.onHoldAmount = onHoldAmount;
+        this.savingsAccountNo = savingsAccountNo;
+        this.amountReleased = amountReleased;
+        this.borrowerName = borrowerName;
+        this.totalOverdue = totalOverdue;
+        this.overdueSinceDate = overdueSinceDate;
+        this.submittedOnDate = submittedOnDate;
+        this.approvedOnDate = approvedOnDate;
+        this.disbursedOnDate = disbursedOnDate;
+        this.expectedMaturityDate = expectedMaturityDate;
+        this.amountRemaining = amountRemaining;
+        this.savingsBalance = savingsBalance;
+        this.missedInstallments = missedInstallments;
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/accounts/constants/ShareAccountApiConstants.java

@@ -60,6 +60,8 @@ public interface ShareAccountApiConstants {
 
     String externalid_paramname = "externalId";
 
+    String resolutionnumber_paramname = "resolutionNumber";
+
     String currency_paramname = "currencyCode";
 
     String digitsafterdecimal_paramname = "digitsAfterDecimal";
@@ -102,9 +104,10 @@ public interface ShareAccountApiConstants {
 
     Set<String> supportedParameters = Collections.unmodifiableSet(new HashSet<>(Arrays.asList(locale_paramname, dateformat_paramname,
             id_paramname, clientid_paramname, productid_paramname, submitteddate_paramname, approveddate_paramname, externalid_paramname,
-            currency_paramname, digitsafterdecimal_paramname, inmultiplesof_paramname, requestedshares_paramname,
-            savingsaccountid_paramname, lockinperiod_paramname, lockperiodfrequencytype_paramname, minimumactiveperiod_paramname,
-            minimumactiveperiodfrequencytype_paramname, allowdividendcalculationforinactiveclients_paramname, charges_paramname,
-            applicationdate_param, purchaseddate_paramname, numberofshares_paramname, purchasedprice_paramname)));
+            resolutionnumber_paramname, currency_paramname, digitsafterdecimal_paramname, inmultiplesof_paramname,
+            requestedshares_paramname, savingsaccountid_paramname, lockinperiod_paramname, lockperiodfrequencytype_paramname,
+            minimumactiveperiod_paramname, minimumactiveperiodfrequencytype_paramname,
+            allowdividendcalculationforinactiveclients_paramname, charges_paramname, applicationdate_param, purchaseddate_paramname,
+            numberofshares_paramname, purchasedprice_paramname)));
 
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/accounts/data/request/AccountRequest.java

@@ -42,6 +42,7 @@ public class AccountRequest implements Serializable {
     private Long numberOfShares;
     private String allowDividendCalculationForInactiveClients;
     private String externalId;
+    private String resolutionNumber;
     private String minimumActivePeriodFrequencyType;
     private Long savingsAccountId;
     private String locale;

fineract-provider/src/main/java/org/apache/fineract/portfolio/address/service/AddressWritePlatformServiceImpl.java

@@ -40,6 +40,7 @@ import org.apache.fineract.portfolio.client.domain.ClientAddress;
 import org.apache.fineract.portfolio.client.domain.ClientAddressRepository;
 import org.apache.fineract.portfolio.client.domain.ClientAddressRepositoryWrapper;
 import org.apache.fineract.portfolio.client.domain.ClientRepositoryWrapper;
+import org.apache.fineract.portfolio.client.service.ClientChangeNotificationService;
 import org.springframework.stereotype.Service;
 
 @Service
@@ -53,6 +54,7 @@ public class AddressWritePlatformServiceImpl implements AddressWritePlatformServ
     private final AddressRepository addressRepository;
     private final ClientAddressRepositoryWrapper clientAddressRepositoryWrapper;
     private final AddressCommandFromApiJsonDeserializer fromApiJsonDeserializer;
+    private final ClientChangeNotificationService clientChangeNotificationService;
 
     @Override
     public CommandProcessingResult addClientAddress(final Long clientId, final Long addressTypeId, final JsonCommand command) {
@@ -170,6 +172,10 @@ public class AddressWritePlatformServiceImpl implements AddressWritePlatformServ
 
         final Address addobj = this.addressRepository.getReferenceById(addressId);
 
+        // Snapshot before mutation — notification-only (no OTP gate for address; see class Javadoc /
+        // feature plan). Compared against the post-update state below to build the change message.
+        final String oldAddressSummary = formatAddressSummary(addobj);
+
         if (!command.stringValueOfParameterNamed("addressLine1").isEmpty()) {
 
             is_address_update = true;
@@ -271,6 +277,38 @@ public class AddressWritePlatformServiceImpl implements AddressWritePlatformServ
         }
         this.clientAddressRepository.saveAndFlush(clientAddressObj);
 
+        if (is_address_update) {
+            final String newAddressSummary = formatAddressSummary(addobj);
+            final Client client = clientAddressObj.getClient();
+            this.clientChangeNotificationService.notifyContactOrAddressChanged(client, ClientChangeNotificationService.FIELD_LABEL_ADDRESS,
+                    oldAddressSummary, newAddressSummary, client.getEmailAddress());
+        }
+
         return new CommandProcessingResultBuilder().withCommandId(command.commandId()).withEntityId(clientAddressObj.getId()).build();
     }
+
+    /**
+     * Human-readable, comma-joined summary of the address's free-text fields — used only for the
+     * change-notification email body (see {@link ClientChangeNotificationService}), not persisted.
+     */
+    private String formatAddressSummary(final Address address) {
+        final StringBuilder sb = new StringBuilder();
+        appendIfPresent(sb, address.getAddressLine1());
+        appendIfPresent(sb, address.getAddressLine2());
+        appendIfPresent(sb, address.getAddressLine3());
+        appendIfPresent(sb, address.getTownVillage());
+        appendIfPresent(sb, address.getCity());
+        appendIfPresent(sb, address.getCountyDistrict());
+        appendIfPresent(sb, address.getPostalCode());
+        return sb.length() == 0 ? "(not set)" : sb.toString();
+    }
+
+    private void appendIfPresent(final StringBuilder sb, final String value) {
+        if (value != null && !value.isBlank()) {
+            if (sb.length() > 0) {
+                sb.append(", ");
+            }
+            sb.append(value);
+        }
+    }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AlertReviewRequest.java

@@ -0,0 +1,33 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/** Request body for {@code POST /v1/aml/alerts/{id}/review}. {@code disposition}: WHITELIST | ESCALATE. */
+@Getter
+@Setter
+@NoArgsConstructor
+public class AlertReviewRequest {
+
+    private String disposition;
+    private String notes;
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlAlertApiResource.java

@@ -0,0 +1,79 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.data.AmlAlertData;
+import org.apache.fineract.portfolio.aml.service.AmlAlertReadPlatformService;
+import org.apache.fineract.portfolio.aml.service.AmlAlertWritePlatformService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/aml/alerts")
+@Component
+@Tag(name = "AML Alerts", description = "Live transaction-monitoring alerts raised by the AML rule engine against savings, loan and fund-transfer activity.")
+@RequiredArgsConstructor
+public class AmlAlertApiResource {
+
+    private final PlatformSecurityContext context;
+    private final AmlAlertReadPlatformService readPlatformService;
+    private final AmlAlertWritePlatformService writePlatformService;
+    private final DefaultToApiJsonSerializer<AmlAlertData> toApiJsonSerializer;
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List AML alerts",
+            description = "Optionally filter by status via ?status= : RAISED, UNDER_REVIEW, WHITELISTED, ESCALATED.")
+    public String retrieveAll(@QueryParam("status") final String status) {
+        this.context.authenticatedUser();
+        final List<AmlAlertData> alerts = this.readPlatformService.retrieve(status);
+        return this.toApiJsonSerializer.serialize(alerts);
+    }
+
+    @POST
+    @Path("{alertId}/review")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "AML Officer first-level review of an alert",
+            description = "disposition WHITELIST closes the alert as a false positive; ESCALATE creates an STR case for Principal Officer review.")
+    public String review(@PathParam("alertId") final Long alertId, final AlertReviewRequest request) {
+        this.context.authenticatedUser().validateHasPermissionTo("REVIEW_AML_ALERT");
+        if ("ESCALATE".equalsIgnoreCase(request.getDisposition())) {
+            this.writePlatformService.escalate(alertId, request.getNotes());
+        } else {
+            this.writePlatformService.whitelist(alertId, request.getNotes());
+        }
+        final AmlAlertData updated = this.readPlatformService.retrieve(null).stream().filter(a -> a.id().equals(alertId)).findFirst()
+                .orElse(null);
+        return this.toApiJsonSerializer.serialize(updated);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlCtrReportApiResource.java

@@ -0,0 +1,72 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import java.time.YearMonth;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.data.AmlCtrReportData;
+import org.apache.fineract.portfolio.aml.service.AmlCtrReportGenerationService;
+import org.apache.fineract.portfolio.aml.service.AmlCtrReportReadPlatformService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/aml/ctr-reports")
+@Component
+@Tag(name = "AML CTR Reports",
+        description = "Monthly, mechanical Cash Transaction Reports - threshold-based, no Principal Officer judgment involved.")
+@RequiredArgsConstructor
+public class AmlCtrReportApiResource {
+
+    private final PlatformSecurityContext context;
+    private final AmlCtrReportReadPlatformService readPlatformService;
+    private final AmlCtrReportGenerationService generationService;
+    private final DefaultToApiJsonSerializer<AmlCtrReportData> toApiJsonSerializer;
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List generated CTR reports")
+    public String retrieveAll() {
+        this.context.authenticatedUser();
+        final List<AmlCtrReportData> reports = this.readPlatformService.retrieveAll();
+        return this.toApiJsonSerializer.serialize(reports);
+    }
+
+    @POST
+    @Path("generate")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Generate the CTR report for a month", description = "month format: yyyy-MM. Idempotent - fails if already generated.")
+    public String generate(final CtrGenerateRequest request) {
+        this.context.authenticatedUser().validateHasPermissionTo("REVIEW_AML_ALERT");
+        final YearMonth month = YearMonth.parse(request.getMonth());
+        this.generationService.generateForMonth(month);
+        return this.toApiJsonSerializer.serialize(this.readPlatformService.retrieveAll());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlStrCaseApiResource.java

@@ -0,0 +1,118 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.data.AmlStrCaseData;
+import org.apache.fineract.portfolio.aml.domain.AmlStrConclusion;
+import org.apache.fineract.portfolio.aml.service.AmlStrCaseReadPlatformService;
+import org.apache.fineract.portfolio.aml.service.AmlStrCaseWritePlatformService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/aml/str-cases")
+@Component
+@Tag(name = "AML STR Cases",
+        description = "Principal-Officer-only investigation and conclusion of escalated AML alerts, and STR filing to FIU-IND.")
+@RequiredArgsConstructor
+public class AmlStrCaseApiResource {
+
+    private final PlatformSecurityContext context;
+    private final AmlStrCaseReadPlatformService readPlatformService;
+    private final AmlStrCaseWritePlatformService writePlatformService;
+    private final DefaultToApiJsonSerializer<AmlStrCaseData> toApiJsonSerializer;
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List AML STR cases")
+    public String retrieveAll() {
+        this.context.authenticatedUser();
+        final List<AmlStrCaseData> cases = this.readPlatformService.retrieveAll();
+        return this.toApiJsonSerializer.serialize(cases);
+    }
+
+    @GET
+    @Path("{strCaseId}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Retrieve one AML STR case")
+    public String retrieveOne(@PathParam("strCaseId") final Long strCaseId) {
+        this.context.authenticatedUser();
+        return this.toApiJsonSerializer.serialize(this.readPlatformService.retrieveOne(strCaseId));
+    }
+
+    @GET
+    @Path("weekly-digest")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Internal MIS digest of STR cases concluded suspicious in the last 7 days",
+            description = "For compliance tracking only - does not replace each case's own 7-working-day FIU filing deadline.")
+    public String weeklyDigest() {
+        this.context.authenticatedUser();
+        final List<AmlStrCaseData> digest = this.readPlatformService.weeklyDigest();
+        return this.toApiJsonSerializer.serialize(digest);
+    }
+
+    @POST
+    @Path("{strCaseId}/assign")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Assign a Principal Officer to an STR case")
+    public String assign(@PathParam("strCaseId") final Long strCaseId, final StrCaseAssignRequest request) {
+        this.context.authenticatedUser().validateHasPermissionTo("CONCLUDE_AML_STR");
+        this.writePlatformService.assignPrincipalOfficer(strCaseId, request.getPrincipalOfficerUserId());
+        return this.toApiJsonSerializer.serialize(this.readPlatformService.retrieveOne(strCaseId));
+    }
+
+    @POST
+    @Path("{strCaseId}/conclude")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Principal Officer conclusion",
+            description = "conclusion NOT_SUSPICIOUS closes the case; SUSPICIOUS sets the 7-working-day FIU filing due date starting today.")
+    public String conclude(@PathParam("strCaseId") final Long strCaseId, final StrCaseConcludeRequest request) {
+        this.context.authenticatedUser().validateHasPermissionTo("CONCLUDE_AML_STR");
+        final AmlStrConclusion conclusion = AmlStrConclusion.valueOf(request.getConclusion());
+        this.writePlatformService.conclude(strCaseId, conclusion, request.getInvestigationNotes(), request.getSourceOfFundsNotes());
+        return this.toApiJsonSerializer.serialize(this.readPlatformService.retrieveOne(strCaseId));
+    }
+
+    @POST
+    @Path("{strCaseId}/file")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Record that the STR has been filed with FIU-IND")
+    public String fileStr(@PathParam("strCaseId") final Long strCaseId, final StrCaseFileRequest request) {
+        this.context.authenticatedUser().validateHasPermissionTo("CONCLUDE_AML_STR");
+        this.writePlatformService.fileStr(strCaseId, request.getReferenceNo());
+        return this.toApiJsonSerializer.serialize(this.readPlatformService.retrieveOne(strCaseId));
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/ClientRiskCategoryHistoryApiResource.java

@@ -0,0 +1,57 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.data.ClientRiskCategoryHistoryData;
+import org.apache.fineract.portfolio.aml.service.ClientRiskCategoryHistoryReadPlatformService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/clients/{clientId}/risk-category-history")
+@Component
+@Tag(name = "Client Risk Category History",
+        description = "Audit trail of a client's KYC risk-category changes, including automatic escalation after repeated AML STR cases.")
+@RequiredArgsConstructor
+public class ClientRiskCategoryHistoryApiResource {
+
+    private final PlatformSecurityContext context;
+    private final ClientRiskCategoryHistoryReadPlatformService readPlatformService;
+    private final DefaultToApiJsonSerializer<ClientRiskCategoryHistoryData> toApiJsonSerializer;
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Retrieve a client's risk-category change history")
+    public String retrieveForClient(@PathParam("clientId") final Long clientId) {
+        this.context.authenticatedUser();
+        final List<ClientRiskCategoryHistoryData> history = this.readPlatformService.retrieveForClient(clientId);
+        return this.toApiJsonSerializer.serialize(history);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/CtrGenerateRequest.java

@@ -0,0 +1,32 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/** Request body for {@code POST /v1/aml/ctr-reports/generate}. {@code month} format: yyyy-MM. */
+@Getter
+@Setter
+@NoArgsConstructor
+public class CtrGenerateRequest {
+
+    private String month;
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/StrCaseAssignRequest.java

@@ -0,0 +1,32 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/** Request body for {@code POST /v1/aml/str-cases/{id}/assign}. */
+@Getter
+@Setter
+@NoArgsConstructor
+public class StrCaseAssignRequest {
+
+    private Long principalOfficerUserId;
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/StrCaseConcludeRequest.java

@@ -0,0 +1,34 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/** Request body for {@code POST /v1/aml/str-cases/{id}/conclude}. {@code conclusion}: NOT_SUSPICIOUS | SUSPICIOUS. */
+@Getter
+@Setter
+@NoArgsConstructor
+public class StrCaseConcludeRequest {
+
+    private String conclusion;
+    private String investigationNotes;
+    private String sourceOfFundsNotes;
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/StrCaseFileRequest.java

@@ -0,0 +1,32 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/** Request body for {@code POST /v1/aml/str-cases/{id}/file}. */
+@Getter
+@Setter
+@NoArgsConstructor
+public class StrCaseFileRequest {
+
+    private String referenceNo;
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlAlertData.java

@@ -0,0 +1,28 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+
+public record AmlAlertData(Long id, String transactionType, Long transactionId, Long clientId, String clientDisplayName,
+        String ruleCode, String ruleDescription, BigDecimal amount, String currencyCode, LocalDateTime raisedOn, String status,
+        String reviewedByUsername, LocalDateTime reviewedOn, String reviewNotes, String disposition) implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlCtrReportData.java

@@ -0,0 +1,26 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+public record AmlCtrReportData(Long id, String reportMonth, LocalDateTime generatedOn, int recordCount, String fileReference,
+        String status, LocalDateTime submittedOn) implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlStrCaseData.java

@@ -0,0 +1,28 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+import java.time.LocalDate;
+
+public record AmlStrCaseData(Long id, Long alertId, Long clientId, String clientDisplayName, String assignedPoUsername,
+        String investigationNotes, String sourceOfFundsNotes, String conclusion, String concludedByUsername, LocalDate concludedOn,
+        LocalDate fiuDueDate, LocalDate strFiledOn, String strReferenceNo, String status, long cumulativeStrCaseCountForClient)
+        implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlTransactionContext.java

@@ -0,0 +1,92 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
+import org.apache.fineract.portfolio.client.domain.Client;
+
+/**
+ * Normalized view of a savings/loan/transfer transaction handed to {@code AmlRuleEvaluationService}
+ * by the business-event listener that observed it. Keeps the evaluation service itself decoupled
+ * from the savings/loan/fund-transfer domain models - each listener is responsible for building
+ * this context (including, where relevant, {@link #windowAggregateAmount}) from the repositories
+ * it already has access to.
+ */
+public final class AmlTransactionContext {
+
+    private final AmlTransactionType transactionType;
+    private final Long transactionId;
+    private final Client client;
+    private final BigDecimal amount;
+    private final String currencyCode;
+    private final LocalDateTime occurredOn;
+    private final boolean cash;
+    /**
+     * For STRUCTURING/VELOCITY rules: the sum of this client's qualifying transactions of this
+     * type within the rule's window, INCLUSIVE of this transaction. Null if not computed - such
+     * rules are simply skipped for this context rather than guessed at.
+     */
+    private final BigDecimal windowAggregateAmount;
+
+    public AmlTransactionContext(AmlTransactionType transactionType, Long transactionId, Client client, BigDecimal amount,
+            String currencyCode, LocalDateTime occurredOn, boolean cash, BigDecimal windowAggregateAmount) {
+        this.transactionType = transactionType;
+        this.transactionId = transactionId;
+        this.client = client;
+        this.amount = amount;
+        this.currencyCode = currencyCode;
+        this.occurredOn = occurredOn;
+        this.cash = cash;
+        this.windowAggregateAmount = windowAggregateAmount;
+    }
+
+    public AmlTransactionType getTransactionType() {
+        return transactionType;
+    }
+
+    public Long getTransactionId() {
+        return transactionId;
+    }
+
+    public Client getClient() {
+        return client;
+    }
+
+    public BigDecimal getAmount() {
+        return amount;
+    }
+
+    public String getCurrencyCode() {
+        return currencyCode;
+    }
+
+    public LocalDateTime getOccurredOn() {
+        return occurredOn;
+    }
+
+    public boolean isCash() {
+        return cash;
+    }
+
+    public BigDecimal getWindowAggregateAmount() {
+        return windowAggregateAmount;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/ClientRiskCategoryHistoryData.java

@@ -0,0 +1,26 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+public record ClientRiskCategoryHistoryData(Long id, Long clientId, Integer previousCategory, Integer newCategory, String reason,
+        String triggeredBy, Long strCaseId, LocalDateTime changedOn, String changedByUsername) implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/event/AmlDomainService.java

@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.event;
+
+/** Marker interface whose only implementation registers AML business-event listeners on startup. */
+public interface AmlDomainService {
+
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/event/AmlDomainServiceImpl.java

@@ -0,0 +1,153 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.event;
+
+import jakarta.annotation.PostConstruct;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.event.business.BusinessEventListener;
+import org.apache.fineract.infrastructure.event.business.domain.loan.transaction.LoanDisbursalTransactionBusinessEvent;
+import org.apache.fineract.infrastructure.event.business.domain.loan.transaction.LoanTransactionMakeRepaymentPostBusinessEvent;
+import org.apache.fineract.infrastructure.event.business.domain.savings.transaction.SavingsDepositBusinessEvent;
+import org.apache.fineract.infrastructure.event.business.domain.savings.transaction.SavingsWithdrawalBusinessEvent;
+import org.apache.fineract.infrastructure.event.business.service.BusinessEventNotifierService;
+import org.apache.fineract.portfolio.aml.data.AmlTransactionContext;
+import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
+import org.apache.fineract.portfolio.aml.repository.AmlLoanTransactionQueryRepository;
+import org.apache.fineract.portfolio.aml.repository.AmlSavingsTransactionQueryRepository;
+import org.apache.fineract.portfolio.aml.service.AmlRuleEvaluationService;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.portfolio.loanaccount.domain.LoanTransaction;
+import org.apache.fineract.portfolio.paymentdetail.domain.PaymentDetail;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccountTransaction;
+
+/**
+ * Registers post-business-event listeners that evaluate every live savings and loan transaction
+ * against the AML rule catalog, purely additively - listeners observe transactions that already
+ * completed successfully and never alter their outcome. Runs synchronously in the same request,
+ * mirroring {@code org.apache.fineract.notification.service.NotificationDomainServiceImpl}, so an
+ * alert is atomic with the transaction that raised it.
+ */
+@RequiredArgsConstructor
+@Slf4j
+public class AmlDomainServiceImpl implements AmlDomainService {
+
+    /**
+     * Fixed lookback used for every STRUCTURING/VELOCITY rule regardless of its own configured
+     * window_days - a v1 approximation (errs toward over-inclusion, the safer failure mode for AML
+     * monitoring) until per-rule windows are wired through.
+     */
+    private static final int STRUCTURING_WINDOW_DAYS = 30;
+
+    private final BusinessEventNotifierService businessEventNotifierService;
+    private final AmlRuleEvaluationService ruleEvaluationService;
+    private final AmlSavingsTransactionQueryRepository savingsQueryRepository;
+    private final AmlLoanTransactionQueryRepository loanQueryRepository;
+
+    @PostConstruct
+    public void addListeners() {
+        businessEventNotifierService.addPostBusinessEventListener(SavingsDepositBusinessEvent.class, new SavingsDepositListener());
+        businessEventNotifierService.addPostBusinessEventListener(SavingsWithdrawalBusinessEvent.class, new SavingsWithdrawalListener());
+        businessEventNotifierService.addPostBusinessEventListener(LoanDisbursalTransactionBusinessEvent.class,
+                new LoanDisbursalListener());
+        businessEventNotifierService.addPostBusinessEventListener(LoanTransactionMakeRepaymentPostBusinessEvent.class,
+                new LoanRepaymentListener());
+    }
+
+    private final class SavingsDepositListener implements BusinessEventListener<SavingsDepositBusinessEvent> {
+
+        @Override
+        public void onBusinessEvent(SavingsDepositBusinessEvent event) {
+            evaluateSavingsTransaction(event.get(), true);
+        }
+    }
+
+    private final class SavingsWithdrawalListener implements BusinessEventListener<SavingsWithdrawalBusinessEvent> {
+
+        @Override
+        public void onBusinessEvent(SavingsWithdrawalBusinessEvent event) {
+            evaluateSavingsTransaction(event.get(), false);
+        }
+    }
+
+    private final class LoanDisbursalListener implements BusinessEventListener<LoanDisbursalTransactionBusinessEvent> {
+
+        @Override
+        public void onBusinessEvent(LoanDisbursalTransactionBusinessEvent event) {
+            evaluateLoanTransaction(event.get());
+        }
+    }
+
+    private final class LoanRepaymentListener implements BusinessEventListener<LoanTransactionMakeRepaymentPostBusinessEvent> {
+
+        @Override
+        public void onBusinessEvent(LoanTransactionMakeRepaymentPostBusinessEvent event) {
+            evaluateLoanTransaction(event.get());
+        }
+    }
+
+    private void evaluateSavingsTransaction(SavingsAccountTransaction transaction, boolean depositDirection) {
+        final Client client = transaction.getSavingsAccount().getClient();
+        if (client == null) {
+            // group/JLG savings with no individual client behind it are out of scope for this rule set
+            return;
+        }
+        final LocalDate since = LocalDate.now().minusDays(STRUCTURING_WINDOW_DAYS);
+        final List<SavingsAccountTransaction> recent = savingsQueryRepository.findForClientSince(client.getId(), since);
+        final BigDecimal windowAggregate = recent.stream().filter(t -> depositDirection ? t.isDeposit() : t.isWithdrawal())
+                .map(SavingsAccountTransaction::getAmount).reduce(BigDecimal.ZERO, BigDecimal::add);
+
+        final AmlTransactionContext context = new AmlTransactionContext(AmlTransactionType.SAVINGS, transaction.getId(), client,
+                transaction.getAmount(), transaction.getSavingsAccount().getCurrency().getCode(),
+                transaction.getDateOf().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate);
+        try {
+            ruleEvaluationService.evaluate(context);
+        } catch (final RuntimeException e) {
+            // AML alerting must never block the underlying savings transaction it is observing
+            log.error("AML rule evaluation failed for savings transaction {}", transaction.getId(), e);
+        }
+    }
+
+    private void evaluateLoanTransaction(LoanTransaction transaction) {
+        final Client client = transaction.getLoan().getClient();
+        if (client == null) {
+            return;
+        }
+        final LocalDate since = LocalDate.now().minusDays(STRUCTURING_WINDOW_DAYS);
+        final List<LoanTransaction> recent = loanQueryRepository.findForClientSince(client.getId(), since);
+        final BigDecimal windowAggregate = recent.stream().filter(LoanTransaction::isRepaymentLikeType)
+                .map(t -> t.getAmount(transaction.getLoan().getCurrency()).getAmount()).reduce(BigDecimal.ZERO, BigDecimal::add);
+
+        final AmlTransactionContext context = new AmlTransactionContext(AmlTransactionType.LOAN, transaction.getId(), client,
+                transaction.getAmount(transaction.getLoan().getCurrency()).getAmount(), transaction.getLoan().getCurrency().getCode(),
+                transaction.getTransactionDate().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate);
+        try {
+            ruleEvaluationService.evaluate(context);
+        } catch (final RuntimeException e) {
+            log.error("AML rule evaluation failed for loan transaction {}", transaction.getId(), e);
+        }
+    }
+
+    private boolean isCash(PaymentDetail paymentDetail) {
+        return paymentDetail == null || Boolean.TRUE.equals(paymentDetail.getPaymentType().getIsCashPayment());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/job/AmlCtrReportBatchJobConfig.java

@@ -0,0 +1,60 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.job;
+
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.apache.fineract.portfolio.aml.service.AmlCtrReportGenerationService;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class AmlCtrReportBatchJobConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+    @Autowired
+    private AmlCtrReportGenerationService generationService;
+
+    @Bean
+    public AmlCtrReportBatchTasklet amlCtrReportBatchTasklet() {
+        return new AmlCtrReportBatchTasklet(generationService);
+    }
+
+    @Bean
+    protected Step amlCtrReportBatchStep() {
+        return new StepBuilder(JobName.CTR_REPORT_GENERATION.name(), jobRepository)
+                .tasklet(amlCtrReportBatchTasklet(), transactionManager).build();
+    }
+
+    @Bean
+    public Job amlCtrReportBatchJob() {
+        return new JobBuilder(JobName.CTR_REPORT_GENERATION.name(), jobRepository).start(amlCtrReportBatchStep())
+                .incrementer(new RunIdIncrementer()).build();
+    }
+}