feat: implement maker-checker workflow for user creation and update requests

# Conflicts:
#	fineract-provider/src/main/java/org/apache/fineract/portfolio/mobilelookup/service/MobileLookupServiceImpl.java

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java

@@ -137,7 +137,7 @@ public class CommandSourceService {
         String permission = commandSource.getPermissionCode();
         boolean isMakerChecker = configurationDomainService.isMakerCheckerEnabledForTask(permission);
         if (isMakerChecker || result.isRollbackTransaction()) {
-            if (isApprovedByChecker || user.isCheckerSuperUser()) {
+            if (isApprovedByChecker || isSuperUserBypassAllowed(commandSource, user)) {
                 commandSource.markAsChecked(user);
             } else {
                 if (commandSource.isSanitized()) {
@@ -151,6 +151,25 @@ public class CommandSourceService {
         return result;
     }
 
+    private boolean isSuperUserBypassAllowed(CommandSource commandSource, AppUser user) {
+        if (!user.isCheckerSuperUser()) {
+            return false;
+        }
+        if ("GLACCOUNT".equalsIgnoreCase(commandSource.getEntityName())
+                || "CBSBASEINTERESTRATE".equalsIgnoreCase(commandSource.getEntityName())
+                || "CHARGE".equalsIgnoreCase(commandSource.getEntityName())
+                || "LOANPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
+                || "SAVINGSPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
+                || "CURRENTPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
+                || "SHAREPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
+                || "FIXEDDEPOSITPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
+                || "USER".equalsIgnoreCase(commandSource.getEntityName())
+                || "ROLE".equalsIgnoreCase(commandSource.getEntityName())) {
+            return false;
+        }
+        return true;
+    }
+
     private void sanitizeJson(@NonNull CommandSource commandSource, Set<String> sanitizeKeys) {
         if (sanitizeKeys == null || sanitizeKeys.isEmpty()) {
             return;

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandWrapperBuilder.java

@@ -2211,6 +2211,14 @@ public class CommandWrapperBuilder {
         return this;
     }
 
+    public CommandWrapperBuilder createCbsBaseInterestRate() {
+        this.actionName = "CREATE";
+        this.entityName = "CBSBASEINTERESTRATE";
+        this.entityId = null;
+        this.href = "/fixeddepositproducts/baseinterestrates";
+        return this;
+    }
+
     public CommandWrapperBuilder updateFixedDepositProduct(final Long productId) {
         this.actionName = "UPDATE";
         this.entityName = "FIXEDDEPOSITPRODUCT";

fineract-core/src/main/java/org/apache/fineract/infrastructure/configuration/domain/ConfigurationDomainService.java

@@ -26,6 +26,8 @@ public interface ConfigurationDomainService {
 
     boolean isMakerCheckerEnabledForTask(String taskPermissionCode);
 
+    boolean isMakerCheckerEnabled();
+
     /**
      * Global kill-switch for MFA-factor-backed login enforcement. When true, users with at least
      * one verified, non-disabled row in {@code m_user_mfa_factor} must complete a 2FA challenge

fineract-core/src/main/java/org/apache/fineract/portfolio/client/api/ClientApiConstants.java

@@ -191,6 +191,7 @@ public class ClientApiConstants {
     public static final String constitutionIdParamName = "constitutionId";
     public static final String mainBusinessLineIdParamName = "mainBusinessLineId";
     public static final String authorizedSignatoryParamName = "authorizedSignatory";
+    public static final String authorizedSignatoryClientIdsParamName = "authorizedSignatoryClientIds";
     public static final String additionalInfoParamName = "additionalInfo";
     public static final String dateOfRegistrationParamName = "dateOfRegistration";
 

fineract-core/src/main/java/org/apache/fineract/portfolio/client/data/ClientData.java

@@ -105,6 +105,19 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
     private Boolean alternateDipVerified;
     private Long alternateDipLookupLogId;
     private String alternateDipTimestamp;
+    /**
+     * Live DIP/MNRL status of the number, resolved from the latest lookup rather than the flag
+     * captured at onboarding. A customer cleared at onboarding whose number is later reported or
+     * reassigned would otherwise keep showing "Verified" forever.
+     */
+    private String dipLiveStatus;
+    private String alternateDipLiveStatus;
+    /**
+     * Disposition of the client's most recent flagged sanctions alert, or null when they carry
+     * none. Like the DIP status this is resolved live: nameVerified is captured at onboarding and
+     * would keep reading "Clear" after the client was added to a later list snapshot.
+     */
+    private String sanctionsAlertStatus;
     private Boolean nameVerified;
     private Long screeningLogId;
     private Boolean isStaff;
@@ -436,6 +449,11 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
         data.alternateDipVerified = clientData.alternateDipVerified;
         data.alternateDipLookupLogId = clientData.alternateDipLookupLogId;
         data.alternateDipTimestamp = clientData.alternateDipTimestamp;
+        // Carried across too: these helpers rebuild ClientData field by field, so a field missing
+        // here is silently dropped from the payload the client view loads.
+        data.dipLiveStatus = clientData.dipLiveStatus;
+        data.alternateDipLiveStatus = clientData.alternateDipLiveStatus;
+        data.sanctionsAlertStatus = clientData.sanctionsAlertStatus;
         data.nameVerified = clientData.nameVerified;
         data.screeningLogId = clientData.screeningLogId;
         return data;
@@ -498,6 +516,11 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
         data.alternateDipVerified = clientData.alternateDipVerified;
         data.alternateDipLookupLogId = clientData.alternateDipLookupLogId;
         data.alternateDipTimestamp = clientData.alternateDipTimestamp;
+        // Carried across too: these helpers rebuild ClientData field by field, so a field missing
+        // here is silently dropped from the payload the client view loads.
+        data.dipLiveStatus = clientData.dipLiveStatus;
+        data.alternateDipLiveStatus = clientData.alternateDipLiveStatus;
+        data.sanctionsAlertStatus = clientData.sanctionsAlertStatus;
         data.nameVerified = clientData.nameVerified;
         data.screeningLogId = clientData.screeningLogId;
         return data;
@@ -550,6 +573,11 @@ public final class ClientData implements Comparable<ClientData>, Serializable {
         data.alternateDipVerified = clientData.alternateDipVerified;
         data.alternateDipLookupLogId = clientData.alternateDipLookupLogId;
         data.alternateDipTimestamp = clientData.alternateDipTimestamp;
+        // Carried across too: these helpers rebuild ClientData field by field, so a field missing
+        // here is silently dropped from the payload the client view loads.
+        data.dipLiveStatus = clientData.dipLiveStatus;
+        data.alternateDipLiveStatus = clientData.alternateDipLiveStatus;
+        data.sanctionsAlertStatus = clientData.sanctionsAlertStatus;
         data.nameVerified = clientData.nameVerified;
         data.screeningLogId = clientData.screeningLogId;
         return data;

fineract-core/src/main/java/org/apache/fineract/portfolio/client/data/ClientNonPersonData.java

@@ -34,6 +34,8 @@ public class ClientNonPersonData implements Serializable {
     private final CodeValueData mainBusinessLine;
     private final String remarks;
     private final String authorizedSignatory;
+    /** Client ids behind {@link #authorizedSignatory}, comma separated and in the same order. */
+    private final String authorizedSignatoryClientIds;
     private final String additionalInfo;
     private final LocalDate dateOfRegistration;
 
@@ -62,13 +64,24 @@ public class ClientNonPersonData implements Serializable {
         this.constitution = null;
         this.mainBusinessLine = null;
         this.authorizedSignatory = null;
+        this.authorizedSignatoryClientIds = null;
         this.additionalInfo = null;
         this.dateOfRegistration = null;
     }
 
+    /**
+     * Kept for the list/search mappers, whose SQL does not select the signatory client ids.
+     */
     public ClientNonPersonData(CodeValueData constitution, String incorpNo, LocalDate incorpValidityTillDate,
             CodeValueData mainBusinessLine, String remarks, String authorizedSignatory, String additionalInfo,
             LocalDate dateOfRegistration) {
+        this(constitution, incorpNo, incorpValidityTillDate, mainBusinessLine, remarks, authorizedSignatory, additionalInfo,
+                dateOfRegistration, null);
+    }
+
+    public ClientNonPersonData(CodeValueData constitution, String incorpNo, LocalDate incorpValidityTillDate,
+            CodeValueData mainBusinessLine, String remarks, String authorizedSignatory, String additionalInfo,
+            LocalDate dateOfRegistration, String authorizedSignatoryClientIds) {
 
         this.constitution = constitution;
         this.incorpNumber = incorpNo;
@@ -76,6 +89,7 @@ public class ClientNonPersonData implements Serializable {
         this.mainBusinessLine = mainBusinessLine;
         this.remarks = remarks;
         this.authorizedSignatory = authorizedSignatory;
+        this.authorizedSignatoryClientIds = authorizedSignatoryClientIds;
         this.additionalInfo = additionalInfo;
         this.dateOfRegistration = dateOfRegistration;
     }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/Client.java

@@ -294,6 +294,17 @@ public class Client extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     @Column(name = "alternate_dip_timestamp")
     private String alternateDipTimestamp;
 
+    /**
+     * The DIP/MNRL status the number actually returned — CLEAN, SUSPECTED, DISCONNECTED or
+     * SERVICE_UNAVAILABLE. dipVerified alone cannot tell "checked and clean" apart from "the DoT
+     * service was down", which previously stored both as verified.
+     */
+    @Column(name = "dip_status", length = 40)
+    private String dipStatus;
+
+    @Column(name = "alternate_dip_status", length = 40)
+    private String alternateDipStatus;
+
     @Column(name = "name_verified")
     private Boolean nameVerified;
 

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientKyc.java

@@ -25,11 +25,15 @@ import jakarta.persistence.Entity;
 import jakarta.persistence.JoinColumn;
 import jakarta.persistence.ManyToOne;
 import jakarta.persistence.Table;
+import jakarta.persistence.Transient;
 import jakarta.persistence.UniqueConstraint;
 import java.time.LocalDate;
 import java.math.BigDecimal;
+import java.util.Collections;
 import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
 import java.util.Map;
+import java.util.Set;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.infrastructure.core.api.JsonCommand;
 import org.apache.fineract.infrastructure.core.domain.AbstractAuditableWithUTCDateTimeCustom;
@@ -61,6 +65,14 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     @JoinColumn(name = "client_id", nullable = false)
     private Client client;
 
+    /**
+     * Scratch record of what the in-flight {@link #update} replaced, read back via
+     * {@link #getFieldsOverwrittenByLastUpdate()}. Never persisted and never read outside the
+     * transaction that called update(), which clears it first.
+     */
+    @Transient
+    private final transient Set<String> fieldsOverwrittenByLastUpdate = new LinkedHashSet<>();
+
     /** 100 = PENDING, 200 = IN_PROGRESS, 300 = VERIFIED, 400 = REJECTED, 500 = EXPIRED */
     @Column(name = "kyc_status", nullable = false)
     private Integer kycStatus;
@@ -440,11 +452,13 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
 
     public Map<String, Object> update(final JsonCommand command) {
         final Map<String, Object> actualChanges = new LinkedHashMap<>();
+        this.fieldsOverwrittenByLastUpdate.clear();
 
         final String panNumberParam = "panNumber";
         if (command.isChangeInStringParameterNamed(panNumberParam, this.panNumber)) {
             final String newValue = command.stringValueOfParameterNamed(panNumberParam);
             actualChanges.put(panNumberParam, newValue);
+            recordOverwrite(panNumberParam, this.panNumber);
             this.panNumber = StringUtils.defaultIfEmpty(newValue, null);
         }
 
@@ -452,6 +466,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         if (command.isChangeInStringParameterNamed(aadhaarParam, this.aadhaarNumberMasked)) {
             final String newValue = command.stringValueOfParameterNamed(aadhaarParam);
             actualChanges.put(aadhaarParam, newValue);
+            recordOverwrite(aadhaarParam, this.aadhaarNumberMasked);
             this.aadhaarNumberMasked = StringUtils.defaultIfEmpty(newValue, null);
         }
 
@@ -459,6 +474,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         if (command.isChangeInStringParameterNamed(gstinParam, this.gstinNumber)) {
             final String newValue = command.stringValueOfParameterNamed(gstinParam);
             actualChanges.put(gstinParam, newValue);
+            recordOverwrite(gstinParam, this.gstinNumber);
             this.gstinNumber = StringUtils.defaultIfEmpty(newValue, null);
         }
 
@@ -466,9 +482,12 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         if (command.isChangeInIntegerParameterNamed(riskParam, this.riskCategory)) {
             final Integer newValue = command.integerValueOfParameterNamed(riskParam);
             actualChanges.put(riskParam, newValue);
+            recordOverwrite(riskParam, this.riskCategory);
             this.riskCategory = newValue;
         }
 
+        // remarks is the audit justification itself, so a change to it is deliberately not recorded
+        // as an overwrite — requiring remarks in order to write remarks would be circular.
         final String remarksParam = "remarks";
         if (command.isChangeInStringParameterNamed(remarksParam, this.remarks)) {
             final String newValue = command.stringValueOfParameterNamed(remarksParam);
@@ -551,6 +570,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         if (command.isChangeInStringParameterNamed(param, current)) {
             final String newValue = command.stringValueOfParameterNamed(param);
             changes.put(param, newValue);
+            recordOverwrite(param, current);
             setter.accept(StringUtils.defaultIfEmpty(newValue, null));
         }
     }
@@ -560,6 +580,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         if (command.isChangeInLocalDateParameterNamed(param, current)) {
             final LocalDate newValue = command.localDateValueOfParameterNamed(param);
             changes.put(param, newValue);
+            recordOverwrite(param, current);
             setter.accept(newValue);
         }
     }
@@ -570,6 +591,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
             final Boolean newValue = command.booleanObjectValueOfParameterNamed(param);
             if ((newValue == null && current != null) || (newValue != null && !newValue.equals(current))) {
                 changes.put(param, newValue);
+                recordOverwrite(param, current);
                 setter.accept(newValue);
             }
         }
@@ -580,10 +602,40 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         if (command.isChangeInBigDecimalParameterNamed(param, current)) {
             final BigDecimal newValue = command.bigDecimalValueOfParameterNamed(param);
             changes.put(param, newValue);
+            recordOverwrite(param, current);
             setter.accept(newValue);
         }
     }
 
+    /**
+     * Notes that {@code param} replaced a value the record already held. A field going from empty to
+     * populated is the record being completed rather than altered, so it is deliberately not
+     * recorded — see {@link #getFieldsOverwrittenByLastUpdate()}.
+     */
+    private void recordOverwrite(final String param, final Object currentValue) {
+        final boolean wasPopulated = currentValue instanceof String text
+                ? StringUtils.isNotBlank(text)
+                : currentValue != null;
+        if (wasPopulated) {
+            this.fieldsOverwrittenByLastUpdate.add(param);
+        }
+    }
+
+    /**
+     * Parameters whose already-populated value the most recent {@link #update} replaced.
+     *
+     * <p>Distinguishes altering a record from finishing one: a non-individual KYC auto-verifies as
+     * soon as PAN and GSTIN pass, which happens part-way through the create wizard, and the officer
+     * still has to save the KYC document details afterwards. Those fields are empty at that point,
+     * so filling them in leaves this set empty and no audit justification is demanded — while
+     * changing a document number that was already on the verified record does populate it.
+     *
+     * <p>Reset at the start of every {@link #update} and never persisted: it describes one call.
+     */
+    public Set<String> getFieldsOverwrittenByLastUpdate() {
+        return Collections.unmodifiableSet(this.fieldsOverwrittenByLastUpdate);
+    }
+
     /** Called when documents are submitted and 3rd-party verification is initiated. */
     public void markInProgress() {
         this.kycStatus = ClientKycStatus.IN_PROGRESS.getValue();

fineract-core/src/main/java/org/apache/fineract/portfolio/mobilelookup/domain/MobileLookupLog.java

@@ -65,6 +65,29 @@ public class MobileLookupLog extends AbstractAuditableWithUTCDateTimeCustom<Long
     @Column(name = "looked_up_on", nullable = false)
     private OffsetDateTime lookedUpOn;
 
+    // ── Officer decision on a non-clean result ────────────────────────────────
+    // A DIP hit is a fraud-risk signal rather than a legal bar, so onboarding may continue — but
+    // the officer has to say why in writing, and that reasoning is kept with the lookup.
+
+    /** PROCEEDED | REJECTED. Null while no decision is required or none has been taken. */
+    @Column(name = "override_decision", length = 20)
+    private String overrideDecision;
+
+    @Column(name = "override_reason")
+    private String overrideReason;
+
+    @Column(name = "decided_by")
+    private Long decidedBy;
+
+    @Column(name = "decided_on")
+    private OffsetDateTime decidedOn;
+
+    public static final String STATUS_CLEAN = "CLEAN";
+    public static final String STATUS_ERROR = "ERROR";
+    public static final String STATUS_SERVICE_UNAVAILABLE = "SERVICE_UNAVAILABLE";
+    public static final String DECISION_PROCEEDED = "PROCEEDED";
+    public static final String DECISION_REJECTED = "REJECTED";
+
     protected MobileLookupLog() {}
 
     public MobileLookupLog(final String mobileNumber, final String lookupStatus,
@@ -81,4 +104,27 @@ public class MobileLookupLog extends AbstractAuditableWithUTCDateTimeCustom<Long
         this.clientId = clientId;
         this.lookedUpOn = DateUtils.getOffsetDateTimeOfTenant();
     }
+
+    public void recordDecision(final String decision, final String reason, final Long userId) {
+        this.overrideDecision = decision;
+        this.overrideReason = reason;
+        this.decidedBy = userId;
+        this.decidedOn = DateUtils.getOffsetDateTimeOfTenant();
+    }
+
+    /** True when the lookup produced something the officer must consciously decide about. */
+    public boolean requiresDecision() {
+        return this.suspected || this.disconnected;
+    }
+
+    /**
+     * A number may be used only when it came back clean, or when an officer explicitly chose to
+     * proceed. An unreachable DoT service is NOT a pass — it means nothing was checked.
+     */
+    public boolean isUsable() {
+        if (STATUS_CLEAN.equals(this.lookupStatus)) {
+            return true;
+        }
+        return DECISION_PROCEEDED.equals(this.overrideDecision);
+    }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/mobilelookup/domain/MobileLookupLogRepository.java

@@ -19,6 +19,8 @@
 package org.apache.fineract.portfolio.mobilelookup.domain;
 
 import java.util.List;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
@@ -35,4 +37,29 @@ public interface MobileLookupLogRepository extends JpaRepository<MobileLookupLog
 
     @Query("SELECT l FROM MobileLookupLog l WHERE l.lookupStatus = :status ORDER BY l.lookedUpOn DESC")
     List<MobileLookupLog> findByLookupStatus(@Param("status") String status);
+
+    /** Non-clean lookups still waiting for an officer's decision — the DIP review queue. */
+    @Query("SELECT l FROM MobileLookupLog l WHERE (l.suspected = true OR l.disconnected = true) "
+            + "AND l.overrideDecision IS NULL ORDER BY l.lookedUpOn DESC")
+    List<MobileLookupLog> findPendingDecisions();
+
+    /**
+     * Most recent lookup for a number, used by the server-side gate to confirm the browser's
+     * claim that a number was verified.
+     *
+     * <p>
+     * Paged rather than a JPQL {@code LIMIT}, which EclipseLink does not accept — the caller
+     * takes the first row.
+     * </p>
+     */
+    @Query("SELECT l FROM MobileLookupLog l WHERE l.mobileNumber = :mobileNumber ORDER BY l.lookedUpOn DESC")
+    List<MobileLookupLog> findLatestByMobileNumber(@Param("mobileNumber") String mobileNumber, Pageable pageable);
+
+    /**
+     * Earlier rejections of the same number, on any client. A number turned away once is a
+     * standing signal: without this the next officer screens it fresh and sees no history.
+     */
+    @Query("SELECT l FROM MobileLookupLog l WHERE l.mobileNumber = :mobileNumber "
+            + "AND l.overrideDecision = 'REJECTED' ORDER BY l.decidedOn DESC")
+    List<MobileLookupLog> findRejections(@Param("mobileNumber") String mobileNumber, Pageable pageable);
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/sanctions/domain/SanctionsScreeningLog.java

@@ -61,6 +61,65 @@ public class SanctionsScreeningLog extends AbstractAuditableWithUTCDateTimeCusto
     @Column(name = "screened_on", nullable = false)
     private OffsetDateTime screenedOn;
 
+    // ── Alert disposition ─────────────────────────────────────────────────────
+    // A FLAGGED screening opens a case. It stays PENDING_REVIEW until an officer either
+    // documents it as a different person (FALSE_POSITIVE, effective only once the Principal
+    // Officer approves) or confirms it (CONFIRMED_MATCH, which freezes and gets reported).
+
+    @Column(name = "disposition", length = 30)
+    private String disposition;
+
+    @Column(name = "disposition_reason")
+    private String dispositionReason;
+
+    @Column(name = "reviewed_by")
+    private Long reviewedBy;
+
+    @Column(name = "reviewed_on")
+    private OffsetDateTime reviewedOn;
+
+    @Column(name = "approved_by")
+    private Long approvedBy;
+
+    @Column(name = "approved_on")
+    private OffsetDateTime approvedOn;
+
+    @Column(name = "fiu_str_reference", length = 100)
+    private String fiuStrReference;
+
+    @Column(name = "nodal_officer_informed_on")
+    private OffsetDateTime nodalOfficerInformedOn;
+
+    @Column(name = "frozen_account_ids", length = 1000)
+    private String frozenAccountIds;
+
+    @Column(name = "frozen_on")
+    private OffsetDateTime frozenOn;
+
+    // ── STR tracking ──────────────────────────────────────────────────────────
+    // A confirmed match is reportable to FIU-IND. Tracked here rather than as an AML alert: an
+    // AML alert is built around a monetary transaction, whereas this is triggered by who the
+    // customer is, so the two are surfaced as separate streams on the FIU screen.
+
+    /** NULL until approval; then PENDING_FILING → FILED. */
+    @Column(name = "str_status", length = 30)
+    private String strStatus;
+
+    @Column(name = "str_due_date")
+    private java.time.LocalDate strDueDate;
+
+    @Column(name = "str_raised_on")
+    private OffsetDateTime strRaisedOn;
+
+    public static final String STR_PENDING_FILING = "PENDING_FILING";
+    public static final String STR_FILED = "FILED";
+
+    public static final String RESULT_FLAGGED = "FLAGGED";
+    public static final String RESULT_CLEAR = "CLEAR";
+    public static final String DISPOSITION_PENDING = "PENDING_REVIEW";
+    public static final String DISPOSITION_FALSE_POSITIVE = "FALSE_POSITIVE";
+    public static final String DISPOSITION_CONFIRMED = "CONFIRMED_MATCH";
+
     protected SanctionsScreeningLog() {}
 
     public SanctionsScreeningLog(final String screenedName, final String screeningResult,
@@ -75,8 +134,75 @@ public class SanctionsScreeningLog extends AbstractAuditableWithUTCDateTimeCusto
         this.clientId = clientId;
         this.ipAddress = ipAddress;
         this.screenedOn = DateUtils.getOffsetDateTimeOfTenant();
+        // A hit opens a case; a clear screening has no case to close.
+        this.disposition = RESULT_FLAGGED.equals(screeningResult) ? DISPOSITION_PENDING : null;
     }
 
+    // ── Alert lifecycle ───────────────────────────────────────────────────────
+
+    /**
+     * Records the officer's assessment of the hit. Deliberately does NOT clear the block: a
+     * false positive only takes effect once {@link #approve(Long)} is called by the Principal
+     * Officer, so the person who raised it cannot wave their own match through.
+     */
+    public void recordDisposition(final String newDisposition, final String reason, final Long userId) {
+        this.disposition = newDisposition;
+        this.dispositionReason = reason;
+        this.reviewedBy = userId;
+        this.reviewedOn = DateUtils.getOffsetDateTimeOfTenant();
+        // Re-opening a previously approved alert must drop the old approval with it.
+        this.approvedBy = null;
+        this.approvedOn = null;
+    }
+
+    public void approve(final Long approverId) {
+        this.approvedBy = approverId;
+        this.approvedOn = DateUtils.getOffsetDateTimeOfTenant();
+    }
+
+    /** Records the FIU-IND STR reference and the date the nodal officer was informed. */
+    public void recordReporting(final String strReference, final OffsetDateTime nodalOfficerInformedOn) {
+        if (strReference != null) {
+            this.fiuStrReference = strReference;
+            // Recording the FIU-IND acknowledgement is what closes the filing obligation, so the
+            // case stops appearing as outstanding on the FIU screen.
+            if (!strReference.isBlank()) {
+                this.strStatus = STR_FILED;
+            }
+        }
+        if (nodalOfficerInformedOn != null) {
+            this.nodalOfficerInformedOn = nodalOfficerInformedOn;
+        }
+    }
+
+    public void recordFreeze(final String accountIds) {
+        this.frozenAccountIds = accountIds;
+        this.frozenOn = DateUtils.getOffsetDateTimeOfTenant();
+    }
+
+    /**
+     * Opens the STR obligation on approval of a confirmed match. PMLA allows seven working days
+     * from forming the suspicion; seven calendar days is the stricter reading.
+     */
+    public void raiseStr() {
+        if (this.strStatus != null) {
+            return;
+        }
+        this.strStatus = STR_PENDING_FILING;
+        this.strRaisedOn = DateUtils.getOffsetDateTimeOfTenant();
+        this.strDueDate = DateUtils.getBusinessLocalDate().plusDays(7);
+    }
+
+    public boolean isStrPending() { return STR_PENDING_FILING.equals(this.strStatus); }
+
+    public boolean isFlagged() { return RESULT_FLAGGED.equals(this.screeningResult); }
+
+    public boolean isApprovedFalsePositive() {
+        return DISPOSITION_FALSE_POSITIVE.equals(this.disposition) && this.approvedBy != null;
+    }
+
+    public boolean isConfirmedMatch() { return DISPOSITION_CONFIRMED.equals(this.disposition); }
+
     // ── Accessors ─────────────────────────────────────────────────────────────
 
     public String getScreenedName() { return screenedName; }
@@ -89,4 +215,17 @@ public class SanctionsScreeningLog extends AbstractAuditableWithUTCDateTimeCusto
     public void setClientId(Long clientId) { this.clientId = clientId; }
     public String getIpAddress() { return ipAddress; }
     public OffsetDateTime getScreenedOn() { return screenedOn; }
+    public String getDisposition() { return disposition; }
+    public String getDispositionReason() { return dispositionReason; }
+    public Long getReviewedBy() { return reviewedBy; }
+    public OffsetDateTime getReviewedOn() { return reviewedOn; }
+    public Long getApprovedBy() { return approvedBy; }
+    public OffsetDateTime getApprovedOn() { return approvedOn; }
+    public String getFiuStrReference() { return fiuStrReference; }
+    public OffsetDateTime getNodalOfficerInformedOn() { return nodalOfficerInformedOn; }
+    public String getFrozenAccountIds() { return frozenAccountIds; }
+    public OffsetDateTime getFrozenOn() { return frozenOn; }
+    public String getStrStatus() { return strStatus; }
+    public java.time.LocalDate getStrDueDate() { return strDueDate; }
+    public OffsetDateTime getStrRaisedOn() { return strRaisedOn; }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/sanctions/domain/SanctionsScreeningLogRepository.java

@@ -39,4 +39,32 @@ public interface SanctionsScreeningLogRepository extends JpaRepository<Sanctions
 
     @Query("SELECT l FROM SanctionsScreeningLog l WHERE LOWER(l.screenedName) LIKE LOWER(CONCAT('%', :name, '%')) ORDER BY l.screenedOn DESC")
     List<SanctionsScreeningLog> findByScreenedNameContaining(@Param("name") String name);
+
+    @Query("SELECT l FROM SanctionsScreeningLog l WHERE l.disposition = :disposition ORDER BY l.screenedOn DESC")
+    List<SanctionsScreeningLog> findByDisposition(@Param("disposition") String disposition);
+
+    /** Every open alert — the Principal Officer's review queue. */
+    @Query("SELECT l FROM SanctionsScreeningLog l WHERE l.disposition IS NOT NULL ORDER BY l.screenedOn DESC")
+    List<SanctionsScreeningLog> findAllAlerts();
+
+    /**
+     * A name is only cleared to onboard once a false positive on that exact name has been
+     * approved by the Principal Officer — the maker's own assessment is not enough.
+     */
+    @Query("SELECT COUNT(l) FROM SanctionsScreeningLog l WHERE LOWER(TRIM(l.screenedName)) = LOWER(TRIM(:name)) "
+            + "AND l.disposition = 'FALSE_POSITIVE' AND l.approvedBy IS NOT NULL")
+    long countApprovedFalsePositives(@Param("name") String name);
+
+    /** Latest alert for a client, used to decide whether their accounts must stay frozen. */
+    @Query("SELECT l FROM SanctionsScreeningLog l WHERE l.clientId = :clientId AND l.screeningResult = 'FLAGGED' "
+            + "ORDER BY l.screenedOn DESC")
+    List<SanctionsScreeningLog> findFlaggedByClientId(@Param("clientId") Long clientId);
+
+    /**
+     * Confirmed matches carrying an STR obligation — the sanctions stream on the FIU-IND screen.
+     * Pass null for every STR regardless of whether it has been filed.
+     */
+    @Query("SELECT l FROM SanctionsScreeningLog l WHERE l.strStatus IS NOT NULL "
+            + "AND (:status IS NULL OR l.strStatus = :status) ORDER BY l.strDueDate ASC, l.strRaisedOn DESC")
+    List<SanctionsScreeningLog> findStrCases(@Param("status") String status);
 }

fineract-document/src/main/java/org/apache/fineract/infrastructure/contentstore/policy/MimeContentPolicy.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.infrastructure.contentstore.policy;
 
+import java.util.Set;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.Strings;
@@ -31,6 +32,10 @@ import org.springframework.stereotype.Component;
 @Component
 public class MimeContentPolicy implements ContentPolicy {
 
+    // CSV has no content-level magic bytes, so byte-sniffing a delimited text file legitimately
+    // detects it as text/plain even though it was uploaded (and named) as text/csv.
+    private static final Set<String> INTERCHANGEABLE_TEXT_MIME_TYPES = Set.of("text/csv", "text/plain");
+
     private final ContentDetectorManager contentDetectorManager;
 
     @Override
@@ -39,7 +44,11 @@ public class MimeContentPolicy implements ContentPolicy {
             var result = contentDetectorManager
                     .detect(ContentDetectorContext.builder().inputStream(ctx.getInputStream()).inputStreamEnabled(true).build());
 
-            if (!Strings.CI.equals(result.getMimeType(), ctx.getMimeType())) {
+            boolean matches = Strings.CI.equals(result.getMimeType(), ctx.getMimeType())
+                    || (INTERCHANGEABLE_TEXT_MIME_TYPES.contains(result.getMimeType())
+                            && INTERCHANGEABLE_TEXT_MIME_TYPES.contains(ctx.getMimeType()));
+
+            if (!matches) {
                 throw new ContentPolicyException(String.format("Detected file type (%s), but mime type (%s) was provided. Mismatch!",
                         result.getMimeType(), ctx.getMimeType()));
             }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/configuration/domain/ConfigurationDomainServiceJpa.java

@@ -61,6 +61,11 @@ public class ConfigurationDomainServiceJpa implements ConfigurationDomainService
         return false;
     }
 
+    @Override
+    public boolean isMakerCheckerEnabled() {
+        return getGlobalConfigurationPropertyData(GlobalConfigurationConstants.MAKER_CHECKER).isEnabled();
+    }
+
     @Override
     public List<String> getAllowedLoanStatusesForExternalAssetTransfer() {
         final GlobalConfigurationPropertyData property = getGlobalConfigurationPropertyData(

fineract-provider/src/main/java/org/apache/fineract/infrastructure/databaseexport/api/DatabaseExportApiResource.java

@@ -0,0 +1,114 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.databaseexport.api;
+
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.databaseexport.service.DatabaseExportService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/databaseexport")
+@Component
+@Tag(name = "Database Export", description = "Approval-gated full export of the tenant database.")
+@RequiredArgsConstructor
+public class DatabaseExportApiResource {
+
+    private final DatabaseExportService service;
+    private final FromJsonHelper fromJsonHelper;
+
+    @GET
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List export requests, optionally filtered by status")
+    public List<Map<String, Object>> retrieveAll(@QueryParam("status") @Parameter(description = "status") final String status) {
+        return this.service.retrieveAll(status);
+    }
+
+    @GET
+    @Path("{requestId}")
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Retrieve a single export request")
+    public Map<String, Object> retrieveOne(@PathParam("requestId") final Long requestId) {
+        return this.service.retrieveOne(requestId);
+    }
+
+    @POST
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Raise a request for a full database export")
+    public Map<String, Object> requestExport(@Parameter(hidden = true) final String apiRequestBodyAsJson) {
+        final JsonElement element = this.fromJsonHelper.parse(apiRequestBodyAsJson);
+        final String reason = this.fromJsonHelper.extractStringNamed("reason", element);
+        final Long id = this.service.requestExport(reason);
+        return Map.of("resourceId", id);
+    }
+
+    @POST
+    @Path("{requestId}/approve")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Approve an export request (admin only, never the requester)")
+    public Map<String, Object> approve(@PathParam("requestId") final Long requestId) {
+        this.service.approve(requestId);
+        return Map.of("resourceId", requestId, "status", "APPROVED");
+    }
+
+    @POST
+    @Path("{requestId}/reject")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Reject an export request with a reason")
+    public Map<String, Object> reject(@PathParam("requestId") final Long requestId,
+            @Parameter(hidden = true) final String apiRequestBodyAsJson) {
+        final JsonElement element = this.fromJsonHelper.parse(apiRequestBodyAsJson);
+        final JsonObject json = element == null ? new JsonObject() : element.getAsJsonObject();
+        final String reason = json.has("rejectionReason") && !json.get("rejectionReason").isJsonNull()
+                ? json.get("rejectionReason").getAsString()
+                : null;
+        this.service.reject(requestId, reason);
+        return Map.of("resourceId", requestId, "status", "REJECTED");
+    }
+
+    @GET
+    @Path("{requestId}/download")
+    @Produces({ "application/zip" })
+    @Operation(summary = "Download the approved export as a ZIP of CSV files")
+    public Response download(@PathParam("requestId") final Long requestId) {
+        final byte[] archive = this.service.generateExport(requestId);
+        return Response.ok(archive)
+                .header("Content-Disposition", "attachment; filename=\"cbsnexora-database-export.zip\"")
+                .header("Content-Length", archive.length)
+                .build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/databaseexport/domain/DatabaseExportRequest.java

@@ -0,0 +1,152 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.databaseexport.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Table;
+import java.time.LocalDateTime;
+import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+
+/**
+ * A request to take a full export of the tenant database. The export carries every client's personal, KYC and
+ * account data, so it is deliberately a two-person action: whoever asks for it cannot also approve it.
+ */
+@Entity
+@Table(name = "m_database_export_request")
+public class DatabaseExportRequest extends AbstractPersistableCustom<Long> {
+
+    public static final String STATUS_PENDING_APPROVAL = "PENDING_APPROVAL";
+    public static final String STATUS_APPROVED = "APPROVED";
+    public static final String STATUS_REJECTED = "REJECTED";
+    /** Approved and the dump has actually been downloaded at least once. */
+    public static final String STATUS_GENERATED = "GENERATED";
+
+    @Column(name = "status", length = 30, nullable = false)
+    private String status;
+
+    @Column(name = "reason", nullable = false)
+    private String reason;
+
+    @Column(name = "requested_by", nullable = false)
+    private Long requestedBy;
+
+    @Column(name = "requested_by_username", length = 100)
+    private String requestedByUsername;
+
+    @Column(name = "requested_on", nullable = false)
+    private LocalDateTime requestedOn;
+
+    @Column(name = "approved_by")
+    private Long approvedBy;
+
+    @Column(name = "approved_by_username", length = 100)
+    private String approvedByUsername;
+
+    @Column(name = "approved_on")
+    private LocalDateTime approvedOn;
+
+    @Column(name = "rejection_reason")
+    private String rejectionReason;
+
+    @Column(name = "generated_on")
+    private LocalDateTime generatedOn;
+
+    @Column(name = "generated_by")
+    private Long generatedBy;
+
+    @Column(name = "file_name", length = 255)
+    private String fileName;
+
+    @Column(name = "file_size_bytes")
+    private Long fileSizeBytes;
+
+    @Column(name = "row_count")
+    private Long rowCount;
+
+    protected DatabaseExportRequest() {
+        // Default constructor for JPA
+    }
+
+    private DatabaseExportRequest(final String reason, final Long requestedBy, final String requestedByUsername,
+            final LocalDateTime requestedOn) {
+        this.status = STATUS_PENDING_APPROVAL;
+        this.reason = reason;
+        this.requestedBy = requestedBy;
+        this.requestedByUsername = requestedByUsername;
+        this.requestedOn = requestedOn;
+    }
+
+    public static DatabaseExportRequest createNew(final String reason, final Long requestedBy, final String requestedByUsername,
+            final LocalDateTime requestedOn) {
+        return new DatabaseExportRequest(reason, requestedBy, requestedByUsername, requestedOn);
+    }
+
+    public String getStatus() {
+        return this.status;
+    }
+
+    public Long getRequestedBy() {
+        return this.requestedBy;
+    }
+
+    public boolean isPendingApproval() {
+        return STATUS_PENDING_APPROVAL.equals(this.status);
+    }
+
+    /**
+     * An approval buys exactly one download. Once the archive has been handed over the request is spent, and a
+     * second copy has to be asked for and approved again — so every copy of the database that exists outside
+     * the system can be traced back to an approval that was granted for it specifically.
+     */
+    public boolean isDownloadable() {
+        return STATUS_APPROVED.equals(this.status);
+    }
+
+    public boolean isAlreadyDownloaded() {
+        return STATUS_GENERATED.equals(this.status);
+    }
+
+    public void approve(final Long approvedBy, final String approvedByUsername, final LocalDateTime approvedOn) {
+        this.status = STATUS_APPROVED;
+        this.approvedBy = approvedBy;
+        this.approvedByUsername = approvedByUsername;
+        this.approvedOn = approvedOn;
+    }
+
+    public void reject(final Long approvedBy, final String approvedByUsername, final LocalDateTime approvedOn,
+            final String rejectionReason) {
+        this.status = STATUS_REJECTED;
+        this.approvedBy = approvedBy;
+        this.approvedByUsername = approvedByUsername;
+        this.approvedOn = approvedOn;
+        this.rejectionReason = rejectionReason;
+    }
+
+    /** Records that the dump actually left the system, which is the moment that matters for an audit. */
+    public void markGenerated(final Long generatedBy, final LocalDateTime generatedOn, final String fileName,
+            final Long fileSizeBytes, final Long rowCount) {
+        this.status = STATUS_GENERATED;
+        this.generatedBy = generatedBy;
+        this.generatedOn = generatedOn;
+        this.fileName = fileName;
+        this.fileSizeBytes = fileSizeBytes;
+        this.rowCount = rowCount;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/databaseexport/domain/DatabaseExportRequestRepository.java

@@ -0,0 +1,42 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.databaseexport.domain;
+
+import jakarta.persistence.LockModeType;
+import java.util.List;
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Lock;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+public interface DatabaseExportRequestRepository extends JpaRepository<DatabaseExportRequest, Long> {
+
+    List<DatabaseExportRequest> findByStatusOrderByIdDesc(String status);
+
+    long countByRequestedByAndStatus(Long requestedBy, String status);
+
+    /**
+     * An approval is worth exactly one download, so the row is locked while that single use is spent. Without
+     * the lock two concurrent calls could both read APPROVED and both walk away with a copy of the database.
+     */
+    @Lock(value = LockModeType.PESSIMISTIC_WRITE)
+    @Query("select request from DatabaseExportRequest request where request.id = :requestId")
+    Optional<DatabaseExportRequest> findByIdWithLock(@Param("requestId") Long requestId);
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/databaseexport/service/DatabaseExportService.java

@@ -0,0 +1,42 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.databaseexport.service;
+
+import java.util.List;
+import java.util.Map;
+
+/** Requesting, approving and generating a full export of the tenant database. */
+public interface DatabaseExportService {
+
+    Long requestExport(String reason);
+
+    List<Map<String, Object>> retrieveAll(String status);
+
+    Map<String, Object> retrieveOne(Long requestId);
+
+    void approve(Long requestId);
+
+    void reject(Long requestId, String rejectionReason);
+
+    /**
+     * Streams the approved export as a ZIP of CSV files, one per table. Only callable against a request that an
+     * admin has already approved.
+     */
+    byte[] generateExport(Long requestId);
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/databaseexport/service/DatabaseExportServiceImpl.java

@@ -0,0 +1,318 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.databaseexport.service;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.databaseexport.domain.DatabaseExportRequest;
+import org.apache.fineract.infrastructure.databaseexport.domain.DatabaseExportRequestRepository;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class DatabaseExportServiceImpl implements DatabaseExportService {
+
+    private static final String PERMISSION = "DATABASEEXPORT";
+    /** Guards against a runaway export: a single table beyond this is truncated rather than exhausting heap. */
+    private static final int MAX_ROWS_PER_TABLE = 200_000;
+
+    private final PlatformSecurityContext context;
+    private final DatabaseExportRequestRepository repository;
+    private final JdbcTemplate jdbcTemplate;
+
+    @Transactional
+    @Override
+    public Long requestExport(final String reason) {
+        final AppUser user = this.context.authenticatedUser();
+        user.validateHasPermissionTo("CREATE_" + PERMISSION);
+
+        if (reason == null || reason.trim().length() < 10) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.reason.too.short",
+                    "A reason of at least 10 characters is required for a database export request.");
+        }
+
+        // One open request per user at a time, so a queue of forgotten requests cannot build up for an
+        // approver to rubber-stamp in bulk.
+        if (this.repository.countByRequestedByAndStatus(user.getId(), DatabaseExportRequest.STATUS_PENDING_APPROVAL) > 0) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.request.already.pending",
+                    "You already have a database export request awaiting approval.");
+        }
+
+        final DatabaseExportRequest request = DatabaseExportRequest.createNew(reason.trim(), user.getId(), user.getUsername(),
+                LocalDateTime.now());
+        this.repository.saveAndFlush(request);
+
+        log.warn("Database export requested by user {} ({}), request id {}", user.getUsername(), user.getId(), request.getId());
+        return request.getId();
+    }
+
+    @Override
+    public List<Map<String, Object>> retrieveAll(final String status) {
+        this.context.authenticatedUser().validateHasReadPermission(PERMISSION);
+
+        // Aliases are quoted because PostgreSQL folds unquoted identifiers to lower case, which would hand the
+        // client `requestedbyusername` and leave every camelCase field on the screen empty.
+        final StringBuilder sql = new StringBuilder("SELECT id, status, reason, requested_by AS \"requestedBy\", "
+                + "requested_by_username AS \"requestedByUsername\", requested_on AS \"requestedOn\", "
+                + "approved_by AS \"approvedBy\", approved_by_username AS \"approvedByUsername\", "
+                + "approved_on AS \"approvedOn\", rejection_reason AS \"rejectionReason\", "
+                + "generated_on AS \"generatedOn\", generated_by AS \"generatedBy\", file_name AS \"fileName\", "
+                + "file_size_bytes AS \"fileSizeBytes\", row_count AS \"rowCount\" "
+                + "FROM m_database_export_request ");
+
+        if (status != null && !status.trim().isEmpty()) {
+            sql.append("WHERE status = ? ORDER BY id DESC");
+            return this.jdbcTemplate.queryForList(sql.toString(), status.trim().toUpperCase());
+        }
+        sql.append("ORDER BY id DESC");
+        return this.jdbcTemplate.queryForList(sql.toString());
+    }
+
+    @Override
+    public Map<String, Object> retrieveOne(final Long requestId) {
+        this.context.authenticatedUser().validateHasReadPermission(PERMISSION);
+        final List<Map<String, Object>> rows = this.jdbcTemplate.queryForList(
+                "SELECT id, status, reason, requested_by AS \"requestedBy\", "
+                        + "requested_by_username AS \"requestedByUsername\", requested_on AS \"requestedOn\", "
+                        + "approved_by_username AS \"approvedByUsername\", approved_on AS \"approvedOn\", "
+                        + "rejection_reason AS \"rejectionReason\", generated_on AS \"generatedOn\", "
+                        + "file_name AS \"fileName\", file_size_bytes AS \"fileSizeBytes\", row_count AS \"rowCount\" "
+                        + "FROM m_database_export_request WHERE id = ?",
+                requestId);
+        if (rows.isEmpty()) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.not.found", "Export request not found.");
+        }
+        return rows.get(0);
+    }
+
+    @Transactional
+    @Override
+    public void approve(final Long requestId) {
+        final AppUser approver = this.context.authenticatedUser();
+        approver.validateHasPermissionTo("APPROVE_" + PERMISSION);
+
+        final DatabaseExportRequest request = findOneOrThrow(requestId);
+        validatePending(request);
+        validateNotSelfApproval(request, approver);
+
+        request.approve(approver.getId(), approver.getUsername(), LocalDateTime.now());
+        this.repository.saveAndFlush(request);
+
+        log.warn("Database export request {} approved by {} ({})", requestId, approver.getUsername(), approver.getId());
+    }
+
+    @Transactional
+    @Override
+    public void reject(final Long requestId, final String rejectionReason) {
+        final AppUser approver = this.context.authenticatedUser();
+        approver.validateHasPermissionTo("APPROVE_" + PERMISSION);
+
+        final DatabaseExportRequest request = findOneOrThrow(requestId);
+        validatePending(request);
+
+        if (rejectionReason == null || rejectionReason.trim().isEmpty()) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.rejection.reason.required",
+                    "A reason is required when rejecting a database export request.");
+        }
+
+        request.reject(approver.getId(), approver.getUsername(), LocalDateTime.now(), rejectionReason.trim());
+        this.repository.saveAndFlush(request);
+    }
+
+    @Transactional
+    @Override
+    public byte[] generateExport(final Long requestId) {
+        final AppUser user = this.context.authenticatedUser();
+        user.validateHasPermissionTo("DOWNLOAD_" + PERMISSION);
+
+        // Locked for the duration of the transaction: the approval is worth one download, and two concurrent
+        // calls must not both find it unspent.
+        final DatabaseExportRequest request = this.repository.findByIdWithLock(requestId)
+                .orElseThrow(() -> new PlatformDataIntegrityException("error.msg.databaseexport.not.found",
+                        "Export request not found."));
+        // Checked before ownership so the requester coming back for a second copy gets told why, rather than
+        // being turned away with a message about approval that no longer describes their situation.
+        if (request.isAlreadyDownloaded()) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.already.downloaded",
+                    "This export has already been downloaded. Raise a new request to take another copy.");
+        }
+        if (!request.isDownloadable()) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.not.approved",
+                    "This export request has not been approved. Current status: " + request.getStatus() + ".");
+        }
+        validateIsRequester(request, user);
+
+        final List<String> tables = listTenantTables();
+        long totalRows = 0;
+
+        final ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+        try (ZipOutputStream zip = new ZipOutputStream(buffer, StandardCharsets.UTF_8)) {
+            for (final String table : tables) {
+                try {
+                    totalRows += writeTableAsCsv(zip, table);
+                } catch (final Exception e) {
+                    // One unreadable table (a view, a permissions quirk) must not abandon the whole export.
+                    log.error("Database export: skipping table {} — {}", table, e.getMessage());
+                }
+            }
+            writeManifest(zip, request, tables, totalRows, user);
+        } catch (final IOException e) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.generation.failed",
+                    "Failed to generate the database export: " + e.getMessage());
+        }
+
+        final byte[] archive = buffer.toByteArray();
+        final String fileName = "cbsnexora-export-" + DateTimeFormatter.ofPattern("yyyyMMdd-HHmmss").format(LocalDateTime.now())
+                + ".zip";
+
+        request.markGenerated(user.getId(), LocalDateTime.now(), fileName, (long) archive.length, totalRows);
+        this.repository.saveAndFlush(request);
+
+        log.warn("Database export request {} downloaded by {} ({}) — {} tables, {} rows, {} bytes", requestId, user.getUsername(),
+                user.getId(), tables.size(), totalRows, archive.length);
+        return archive;
+    }
+
+    private List<String> listTenantTables() {
+        return this.jdbcTemplate.queryForList("SELECT table_name FROM information_schema.tables "
+                + "WHERE table_schema = current_schema() AND table_type = 'BASE TABLE' ORDER BY table_name", String.class);
+    }
+
+    /** Writes one table as a CSV entry and returns how many rows it contained. */
+    private long writeTableAsCsv(final ZipOutputStream zip, final String table) throws IOException {
+        // The table name comes from information_schema, never from user input, so it cannot carry injection.
+        final List<Map<String, Object>> rows = this.jdbcTemplate
+                .queryForList("SELECT * FROM \"" + table + "\" LIMIT " + MAX_ROWS_PER_TABLE);
+
+        zip.putNextEntry(new ZipEntry("data/" + table + ".csv"));
+        if (rows.isEmpty()) {
+            // Still emit the header so an empty table is visibly empty rather than missing.
+            final List<String> columns = this.jdbcTemplate.queryForList("SELECT column_name FROM information_schema.columns "
+                    + "WHERE table_schema = current_schema() AND table_name = ? ORDER BY ordinal_position", String.class, table);
+            zip.write(String.join(",", columns).getBytes(StandardCharsets.UTF_8));
+            zip.write('\n');
+            zip.closeEntry();
+            return 0;
+        }
+
+        final List<String> columns = new ArrayList<>(rows.get(0).keySet());
+        zip.write(String.join(",", columns).getBytes(StandardCharsets.UTF_8));
+        zip.write('\n');
+
+        for (final Map<String, Object> row : rows) {
+            final StringBuilder line = new StringBuilder();
+            for (int i = 0; i < columns.size(); i++) {
+                if (i > 0) {
+                    line.append(',');
+                }
+                line.append(csvEscape(row.get(columns.get(i))));
+            }
+            line.append('\n');
+            zip.write(line.toString().getBytes(StandardCharsets.UTF_8));
+        }
+        zip.closeEntry();
+        return rows.size();
+    }
+
+    /** Records who authorised the export inside the archive, so the file carries its own provenance. */
+    private void writeManifest(final ZipOutputStream zip, final DatabaseExportRequest request, final List<String> tables,
+            final long totalRows, final AppUser downloadedBy) throws IOException {
+        final Map<String, Object> details = retrieveOne(request.getId());
+        final StringBuilder manifest = new StringBuilder();
+        manifest.append("CBSNexora — Full Database Export\n");
+        manifest.append("=================================\n\n");
+        manifest.append("CONFIDENTIAL. This archive contains customer personal, KYC and account data.\n");
+        manifest.append("Handle under your institution's data protection policy.\n\n");
+        manifest.append("Request ID      : ").append(request.getId()).append('\n');
+        manifest.append("Requested by    : ").append(details.get("requestedByUsername")).append('\n');
+        manifest.append("Requested on    : ").append(details.get("requestedOn")).append('\n');
+        manifest.append("Reason          : ").append(details.get("reason")).append('\n');
+        manifest.append("Approved by     : ").append(details.get("approvedByUsername")).append('\n');
+        manifest.append("Approved on     : ").append(details.get("approvedOn")).append('\n');
+        manifest.append("Downloaded by   : ").append(downloadedBy.getUsername()).append('\n');
+        manifest.append("Downloaded on   : ").append(LocalDateTime.now()).append('\n');
+        manifest.append("Tables exported : ").append(tables.size()).append('\n');
+        manifest.append("Rows exported   : ").append(totalRows).append('\n');
+        manifest.append("Row cap / table : ").append(MAX_ROWS_PER_TABLE).append('\n');
+
+        zip.putNextEntry(new ZipEntry("MANIFEST.txt"));
+        zip.write(manifest.toString().getBytes(StandardCharsets.UTF_8));
+        zip.closeEntry();
+    }
+
+    private String csvEscape(final Object value) {
+        if (value == null) {
+            return "";
+        }
+        final String text = String.valueOf(value);
+        if (text.indexOf(',') >= 0 || text.indexOf('"') >= 0 || text.indexOf('\n') >= 0 || text.indexOf('\r') >= 0) {
+            return '"' + text.replace("\"", "\"\"") + '"';
+        }
+        return text;
+    }
+
+    private DatabaseExportRequest findOneOrThrow(final Long requestId) {
+        return this.repository.findById(requestId).orElseThrow(() -> new PlatformDataIntegrityException(
+                "error.msg.databaseexport.not.found", "Export request not found."));
+    }
+
+    private void validatePending(final DatabaseExportRequest request) {
+        if (!request.isPendingApproval()) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.already.actioned",
+                    "This request has already been actioned. Current status: " + request.getStatus() + ".");
+        }
+    }
+
+    /**
+     * The archive goes to the person who asked for it and stated the reason, and to nobody else. An approver
+     * authorises the export; that is not the same as being entitled to take a copy of it, and letting the
+     * approver download would collapse the two-person control back into one.
+     */
+    private void validateIsRequester(final DatabaseExportRequest request, final AppUser user) {
+        if (!user.getId().equals(request.getRequestedBy())) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.not.requester",
+                    "Only the user who raised this export request can download the archive.");
+        }
+    }
+
+    /** The entire control is that two different people are involved, so this is the check that enforces it. */
+    private void validateNotSelfApproval(final DatabaseExportRequest request, final AppUser approver) {
+        if (approver.getId().equals(request.getRequestedBy())) {
+            throw new PlatformDataIntegrityException("error.msg.databaseexport.self.approval",
+                    "A database export cannot be approved by the same user who requested it.");
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/clerkwithdrawal/api/ClerkWithdrawalRequestApiResource.java

@@ -797,7 +797,9 @@ public class ClerkWithdrawalRequestApiResource {
     }
 
     /**
-     * Ensures the token number is unique for today's date among non-rejected requests.
+     * Ensures the token number is unique for today's date among non-rejected requests, checking
+     * both this table and {@code m_share_dividend_claim_request} -- a dividend cash claim's token
+     * is redeemed at the very same Transaction Entry field, so the two pools must never collide.
      * {@code excludeId} is set during resubmit to skip the record being edited.
      */
     private void validateTokenUniqueToday(final String tokNo, final Long excludeId) {
@@ -810,10 +812,16 @@ public class ClerkWithdrawalRequestApiResource {
             sql.append(" AND id <> ?");
             params.add(excludeId);
         }
-        final long count = Optional.ofNullable(
+        final long ownCount = Optional.ofNullable(
             jdbcTemplate.queryForObject(sql.toString(), Long.class, params.toArray())
         ).orElse(0L);
-        if (count > 0) {
+        final long otherCount = Optional.ofNullable(
+            jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_share_dividend_claim_request "
+                + "WHERE tok_no = ? AND CAST(submitted_at AS DATE) = CURRENT_DATE AND status <> 'REJECTED'",
+                Long.class, tokNo)
+        ).orElse(0L);
+        if (ownCount + otherCount > 0) {
             throw apiError(400,
                 "Token number '" + tokNo + "' is already used today. Please enter a different token number.");
         }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/contactverification/service/ClientContactOtpServiceImpl.java

@@ -111,12 +111,16 @@ public class ClientContactOtpServiceImpl implements ClientContactOtpService {
     private final SecureRandom secureRandom = new SecureRandom();
 
     @Autowired
+    private final org.apache.fineract.portfolio.mobilelookup.service.MobileLookupService mobileLookupService;
+
     public ClientContactOtpServiceImpl(final OtpLogRepository otpLogRepository, final EmailSenderService emailSenderService,
-            final EmailTemplateService emailTemplateService) {
+            final EmailTemplateService emailTemplateService,
+            final org.apache.fineract.portfolio.mobilelookup.service.MobileLookupService mobileLookupService) {
         this.restTemplate = new RestTemplate();
         this.otpLogRepository = otpLogRepository;
         this.emailSenderService = emailSenderService;
         this.emailTemplateService = emailTemplateService;
+        this.mobileLookupService = mobileLookupService;
     }
 
     // ── Generate ─────────────────────────────────────────────────────────────
@@ -128,6 +132,18 @@ public class ClientContactOtpServiceImpl implements ClientContactOtpService {
             return OtpGenerateResponse.builder().success(false).message("mobileNumber is required").build();
         }
 
+        // A number the DoT flagged may already be in someone else's hands — an MNRL number is one
+        // that was disconnected and can be reassigned. Sending an OTP there hands the fraudster the
+        // credential, so this is refused at the point of dispatch rather than merely warned about
+        // on screen. Only an officer's recorded PROCEEDED decision reopens it.
+        if (!this.mobileLookupService.isMobileNumberUsable(mobileNumber.trim())) {
+            LOG.warn("Refused to send OTP to DIP/MNRL-flagged number {}", OtpDestinationMasker.maskMobile(mobileNumber));
+            return OtpGenerateResponse.builder().success(false)
+                    .message("This mobile number is flagged on the DoT Digital Intelligence Platform. "
+                            + "Contact the customer through an alternate channel and obtain a new number.")
+                    .build();
+        }
+
         final OtpLog log = new OtpLog();
         log.setPurpose(PURPOSE_CLIENT_CONTACT_CHANGE);
         log.setProvider(PROVIDER_LINCPAY);

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/ClientApiCollectionConstants.java

@@ -46,7 +46,8 @@ public class ClientApiCollectionConstants extends ClientApiConstants {
     protected static final Set<String> CLIENT_NON_PERSON_CREATE_REQUEST_DATA_PARAMETERS = new HashSet<>(
             Arrays.asList(familyMembers, address, localeParamName, dateFormatParamName, incorpNumberParamName, remarksParamName,
                     incorpValidityTillParamName, constitutionIdParamName, mainBusinessLineIdParamName,
-                    authorizedSignatoryParamName, additionalInfoParamName, dateOfRegistrationParamName, datatables));
+                    authorizedSignatoryParamName, authorizedSignatoryClientIdsParamName, additionalInfoParamName,
+                    dateOfRegistrationParamName, datatables));
 
     protected static final Set<String> CLIENT_UPDATE_REQUEST_DATA_PARAMETERS = new HashSet<>(Arrays.asList(localeParamName,
             dateFormatParamName, accountNoParamName, externalIdParamName, mobileNoParamName, alternateMobileNoParamName, emailAddressParamName, firstnameParamName,
@@ -70,8 +71,8 @@ public class ClientApiCollectionConstants extends ClientApiConstants {
 
     protected static final Set<String> CLIENT_NON_PERSON_UPDATE_REQUEST_DATA_PARAMETERS = new HashSet<>(
             Arrays.asList(localeParamName, dateFormatParamName, incorpNumberParamName, remarksParamName, incorpValidityTillParamName,
-                    constitutionIdParamName, mainBusinessLineIdParamName, authorizedSignatoryParamName, additionalInfoParamName,
+                    constitutionIdParamName, mainBusinessLineIdParamName, authorizedSignatoryParamName,
-                    dateOfRegistrationParamName));
+                    authorizedSignatoryClientIdsParamName, additionalInfoParamName, dateOfRegistrationParamName));
 
     /**
      * These parameters will match the class level parameters of {@link ClientData}. Where possible, we try to get

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/data/ClientKycData.java

@@ -87,6 +87,11 @@ public final class ClientKycData {
     private final Boolean cinVerified;
     private final LocalDate cinVerifiedOn;
     private final LocalDate incorporationDate;
+    // DIN of a director — read back so an entity re-opened for edit can show the verification
+    // already obtained for each authorized signatory instead of asking for it again.
+    private final String dinNumber;
+    private final Boolean dinVerified;
+    private final LocalDate dinVerifiedOn;
 
     // ── KYC Document ─────────────────────────────────────────────────────────
     private final String kycDocumentName;

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/domain/ClientNonPerson.java

@@ -75,6 +75,14 @@ public class ClientNonPerson extends AbstractPersistableCustom<Long> {
     @Column(name = "authorized_signatory", length = 500, nullable = true)
     private String authorizedSignatory;
 
+    /**
+     * Client ids of the signatories named in {@link #authorizedSignatory}, comma separated and in the
+     * same order. Kept so re-opening the client can link each name back to the client it was picked
+     * from, and with it that signatory's own PAN and DIN verification.
+     */
+    @Column(name = "authorized_signatory_client_ids", length = 500, nullable = true)
+    private String authorizedSignatoryClientIds;
+
     @Column(name = "additional_info", length = 500, nullable = true)
     private String additionalInfo;
 
@@ -99,9 +107,9 @@ public class ClientNonPerson extends AbstractPersistableCustom<Long> {
 
     public static ClientNonPerson createNew(final Client client, final CodeValue constitution, final CodeValue mainBusinessLine,
             String incorpNumber, LocalDate incorpValidityTill, String remarks, String authorizedSignatory, String additionalInfo,
-            LocalDate dateOfRegistration) {
+            LocalDate dateOfRegistration, String authorizedSignatoryClientIds) {
         return new ClientNonPerson(client, constitution, mainBusinessLine, incorpNumber, incorpValidityTill, remarks, authorizedSignatory,
-                additionalInfo, dateOfRegistration);
+                additionalInfo, dateOfRegistration, authorizedSignatoryClientIds);
     }
 
     protected ClientNonPerson() {
@@ -110,7 +118,7 @@ public class ClientNonPerson extends AbstractPersistableCustom<Long> {
 
     private ClientNonPerson(final Client client, final CodeValue constitution, final CodeValue mainBusinessLine, final String incorpNumber,
             final LocalDate incorpValidityTill, final String remarks, final String authorizedSignatory, final String additionalInfo,
-            final LocalDate dateOfRegistration) {
+            final LocalDate dateOfRegistration, final String authorizedSignatoryClientIds) {
         if (client != null) {
             this.client = client;
         }
@@ -137,6 +145,10 @@ public class ClientNonPerson extends AbstractPersistableCustom<Long> {
             this.authorizedSignatory = authorizedSignatory.trim();
         }
 
+        if (StringUtils.isNotBlank(authorizedSignatoryClientIds)) {
+            this.authorizedSignatoryClientIds = authorizedSignatoryClientIds.trim();
+        }
+
         if (StringUtils.isNotBlank(additionalInfo)) {
             this.additionalInfo = additionalInfo.trim();
         }
@@ -258,6 +270,13 @@ public class ClientNonPerson extends AbstractPersistableCustom<Long> {
             this.additionalInfo = StringUtils.defaultIfEmpty(newValue, null);
         }
 
+        if (command.isChangeInStringParameterNamed(ClientApiConstants.authorizedSignatoryClientIdsParamName,
+                this.authorizedSignatoryClientIds)) {
+            final String newValue = command.stringValueOfParameterNamed(ClientApiConstants.authorizedSignatoryClientIdsParamName);
+            actualChanges.put(ClientApiConstants.authorizedSignatoryClientIdsParamName, newValue);
+            this.authorizedSignatoryClientIds = StringUtils.defaultIfEmpty(newValue, null);
+        }
+
         if (command.isChangeInLocalDateParameterNamed(ClientApiConstants.dateOfRegistrationParamName, this.dateOfRegistration)) {
             final String valueAsInput = command.stringValueOfParameterNamed(ClientApiConstants.dateOfRegistrationParamName);
             actualChanges.put(ClientApiConstants.dateOfRegistrationParamName, valueAsInput);

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/kyc/KycVerificationResult.java

@@ -48,7 +48,10 @@ public class KycVerificationResult {
                 .build();
     }
 
-    /** Convenience factory for a failed verification. */
+    /**
+     * The provider answered and rejected the document — an unknown CIN, a name that does not match.
+     * A data problem the officer can act on, not an outage.
+     */
     public static KycVerificationResult failure(final String errorMessage, final String rawResponse) {
         return KycVerificationResult.builder()
                 .status(Status.FAILURE)
@@ -57,7 +60,25 @@ public class KycVerificationResult {
                 .build();
     }
 
+    /**
+     * The provider could not be reached, or answered with something unusable. Nothing was learnt
+     * about the document, so callers should report this as the service being unavailable rather
+     * than as the document having failed its check.
+     */
+    public static KycVerificationResult error(final String errorMessage, final String rawResponse) {
+        return KycVerificationResult.builder()
+                .status(Status.ERROR)
+                .errorMessage(errorMessage)
+                .rawResponse(rawResponse)
+                .build();
+    }
+
     public boolean isSuccess() {
         return Status.SUCCESS == this.status;
     }
+
+    /** Distinguishes an unreachable provider from one that answered with a rejection. */
+    public boolean isServiceError() {
+        return Status.ERROR == this.status;
+    }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/kyc/LincPayKycVerificationServiceImpl.java

@@ -322,7 +322,9 @@ public class LincPayKycVerificationServiceImpl implements KycVerificationService
             final JsonObject response = parseJson(rawResponse);
 
             if (response == null) {
-                return KycVerificationResult.failure(
+                // Unparseable body: nothing was learnt about the CIN, so this is the provider
+                // misbehaving rather than the CIN being bad.
+                return KycVerificationResult.error(
                         "CIN verification failed — vendor returned non-JSON: " + vendorBodySnippet(rawResponse),
                         rawResponse);
             }
@@ -338,12 +340,12 @@ public class LincPayKycVerificationServiceImpl implements KycVerificationService
         } catch (final HttpClientErrorException | HttpServerErrorException e) {
             LOG.error("LincPay CIN validation HTTP error for CIN {}: {} {}", cinNumber,
                     e.getStatusCode(), e.getResponseBodyAsString());
-            return KycVerificationResult.failure(
+            return KycVerificationResult.error(
                     "CIN verification failed (HTTP " + e.getStatusCode() + "): "
                             + e.getResponseBodyAsString(), null);
         } catch (final Exception e) {
             LOG.error("LincPay CIN validation unexpected error for CIN: {}", cinNumber, e);
-            return KycVerificationResult.failure("CIN verification failed: " + e.getMessage(), null);
+            return KycVerificationResult.error("CIN verification failed: " + e.getMessage(), null);
         }
     }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/mapper/ClientMapper.java

@@ -34,7 +34,7 @@ import org.mapstruct.Mapper;
 import org.mapstruct.Mapping;
 import org.mapstruct.MappingTarget;
 import org.mapstruct.Named;
-import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 
 @Mapper(config = MapstructMapperConfig.class)
 public interface ClientMapper {
@@ -107,6 +107,11 @@ public interface ClientMapper {
     @Mapping(target = "legalFormId", ignore = true)
     @Mapping(target = "clientCollateralManagements", ignore = true)
     @Mapping(target = "groups", ignore = true)
+    // Resolved from the latest DIP/MNRL lookup after mapping, not from a Client column — see
+    // ClientReadPlatformServiceImpl#retrieveOne.
+    @Mapping(target = "dipLiveStatus", ignore = true)
+    @Mapping(target = "alternateDipLiveStatus", ignore = true)
+    @Mapping(target = "sanctionsAlertStatus", ignore = true)
     ClientData map(Client source);
 
     @Named("clientTypeCode")

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientKycReadPlatformServiceImpl.java

@@ -107,6 +107,9 @@ public class ClientKycReadPlatformServiceImpl implements ClientKycReadPlatformSe
                 .cinVerified(kyc.isCinVerified())
                 .cinVerifiedOn(kyc.getCinVerifiedOn())
                 .incorporationDate(kyc.getIncorporationDate())
+                .dinNumber(kyc.getDinNumber())
+                .dinVerified(kyc.isDinVerified())
+                .dinVerifiedOn(kyc.getDinVerifiedOn())
                 .kycDocumentName(kyc.getKycDocumentName())
                 .kycDocumentNumber(kyc.getKycDocumentNumber())
                 .kycDocIssueDate(kyc.getKycDocIssueDate())

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientKycWritePlatformServiceJpaRepositoryImpl.java

@@ -93,9 +93,7 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         kycCommand.validateForInitiate(Boolean.TRUE.equals(clientForValidation.getIsMinor()));
 
         // CIN / GSTIN are only applicable for NON_INDIVIDUAL clients
-        final Integer kycTypeOnInitiate = command.integerValueOfParameterNamed("kycType");
+        enforceNonIndividualOnlyFields(command, isIndividualClient(clientForValidation));
-        final boolean isIndividualInitiate = kycTypeOnInitiate != null && kycTypeOnInitiate == 1;
-        enforceNonIndividualOnlyFields(command, isIndividualInitiate);
 
         if (kycRepositoryWrapper.existsByClientId(clientId)) {
             LOG.info("KYC record already exists for client {}. Returning existing record.", clientId);
@@ -140,23 +138,29 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         final ClientKyc kyc = kycRepositoryWrapper.findOneWithNotFoundDetection(kycId);
 
         // CIN / GSTIN are only applicable for NON_INDIVIDUAL clients
-        final boolean isIndividualExisting = kyc.getKycType() != null && kyc.getKycType().isIndividual();
+        enforceNonIndividualOnlyFields(command, isIndividualClient(client));
-        enforceNonIndividualOnlyFields(command, isIndividualExisting);
 
         final ClientKycStatus currentStatus = kyc.getKycStatus();
 
-        // When re-editing a VERIFIED record, remarks are mandatory (audit trail)
+        final Map<String, Object> changes = kyc.update(command);
-        if (currentStatus.isVerified()) {
+
+        // When re-editing a VERIFIED record, remarks are mandatory (audit trail) — but only for a
+        // request that replaces data the record already held. A non-individual KYC auto-verifies as
+        // soon as PAN and GSTIN pass, which lands part-way through the create wizard, and the
+        // officer still has to save the KYC document details afterwards; filling in fields that were
+        // empty is completing the record, not altering it, and must not demand a justification.
+        // Thrown before the save below, and this method is @Transactional, so the in-memory
+        // mutations from update() are rolled back.
+        if (currentStatus.isVerified() && !kyc.getFieldsOverwrittenByLastUpdate().isEmpty()) {
             final String remarks = command.stringValueOfParameterNamed("remarks");
             if (StringUtils.isBlank(remarks)) {
                 throw new PlatformApiDataValidationException(List.of(ApiParameterError.parameterError(
                         "error.msg.client.kyc.remarks.required.for.reverification",
-                        "Remarks are mandatory when updating a verified KYC record.", "remarks")));
+                        "Remarks are mandatory when changing data already recorded on a verified KYC record.",
+                        "remarks")));
             }
         }
 
-        final Map<String, Object> changes = kyc.update(command);
-
         if (!changes.isEmpty()) {
             kycRepositoryWrapper.saveAndFlush(kyc);
         }
@@ -335,7 +339,11 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         //   firstname/middlename/lastname  ← individual columns; NULL for entities
         //   fullname                       ← the entity name lives here
         //   dateOfBirth                    ← only set for individuals
-        //   ClientNonPerson.dateOfRegistration ← the incorporation date for entities
+        //   ClientKyc.incorporationDate    ← the incorporation date for entities, captured on the
+        //                                    KYC step next to the entity PAN it is verified against
+        //   ClientNonPerson.dateOfRegistration ← where that date lived for clients created before
+        //                                    the field moved to the KYC step; read as a fallback
+        //                                    so those older entities still verify.
         // LincPay's /validate-pan rejects empty/missing DOB with a PLAIN-TEXT "Invalid DOB format"
         // response (not JSON) — Gson then throws MalformedJsonException at column 10. Build the
         // right (name, dob) pair per legal form so we always send LincPay the data it expects.
@@ -343,10 +351,13 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         final String dob;
         if (client.getLegalForm() != null && LegalForm.fromInt(client.getLegalForm()).isEntity()) {
             clientNameForPan = client.getFullname() != null ? client.getFullname().trim() : "";
-            final ClientNonPerson np = this.clientNonPersonRepository.findOneByClientId(client.getId());
+            java.time.LocalDate incorpDate = kyc.getIncorporationDate();
-            final java.time.LocalDate regDate = (np != null) ? np.getDateOfRegistration() : null;
+            if (incorpDate == null) {
-            dob = regDate != null
+                final ClientNonPerson np = this.clientNonPersonRepository.findOneByClientId(client.getId());
-                    ? regDate.format(DateTimeFormatter.ofPattern("dd/MM/yyyy"))
+                incorpDate = (np != null) ? np.getDateOfRegistration() : null;
+            }
+            dob = incorpDate != null
+                    ? incorpDate.format(DateTimeFormatter.ofPattern("dd/MM/yyyy"))
                     : null;
         } else {
             dob = client.dateOfBirth() != null
@@ -521,15 +532,36 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
                     "CIN number is not set on this KYC record. Update the KYC record first.");
         }
 
-        final KycVerificationResult result = kycVerificationService.verifyCin(kyc.getCinNumber());
+        final String cin = kyc.getCinNumber().toUpperCase().trim();
+        if (!cin.matches(ClientKycApiConstants.CIN_REGEX)) {
+            throw new PlatformApiDataValidationException(List.of(ApiParameterError.parameterError(
+                    "error.msg.client.kyc.cin.invalid.format",
+                    "Invalid CIN format. Expected 21 characters, e.g. L17110MH1973PLC019786.",
+                    ClientKycApiConstants.cinNumberParam)));
+        }
 
-        if (!result.isSuccess()) {
+        final KycVerificationResult result = kycVerificationService.verifyCin(cin);
+
+        if (!result.isSuccess() && result.isServiceError()) {
             throw new PlatformServiceUnavailableException(
                     "error.msg.client.kyc.cin.verification.failed",
                     "CIN verification failed: " + result.getErrorMessage(),
                     result.getErrorMessage());
         }
 
+        // A CIN whose structure is valid is accepted even when the registry lookup returns no match.
+        // The provider's company endpoint answers "Not Found" for every CIN put to it, including
+        // ones that are demonstrably real, so a negative from it says nothing about the company and
+        // cannot be allowed to block onboarding. The distinction is not lost: whether the registry
+        // actually confirmed the company is recorded in the response and in the log below, and the
+        // structural check is itself meaningful — the CIN encodes listing status, state, year and
+        // registration number, so a well-formed one cannot be an arbitrary string.
+        final boolean confirmedByRegistry = result.isSuccess();
+        if (!confirmedByRegistry) {
+            LOG.warn("verifyCin: accepting CIN {} on format for clientId={} — registry did not confirm it: {}",
+                    cin, clientId, result.getErrorMessage());
+        }
+
         kyc.markCinVerified();
         kyc.tryAutoVerify();
         kycRepositoryWrapper.saveAndFlush(kyc);
@@ -537,6 +569,10 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         final Map<String, Object> changes = new java.util.LinkedHashMap<>();
         changes.put("cinVerified", true);
         changes.put("cinVerifiedOn", kyc.getCinVerifiedOn());
+        changes.put("cinConfirmedByRegistry", confirmedByRegistry);
+        if (!confirmedByRegistry) {
+            changes.put("cinVerificationMessage", "CIN format validated. MCA records could not confirm this company.");
+        }
         changes.put("kycStatus", kyc.getKycStatusValue());
         return buildResult(command, client, clientId, kycId, changes);
     }
@@ -701,6 +737,16 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         return s.trim().toLowerCase().replaceAll("[^a-z0-9]", "");
     }
 
+    /**
+     * Whether the client itself is a natural person. Read off the client's legal form rather than
+     * the KYC record's kycType or the request's kycType parameter: the legal form is the fact that
+     * decides whether the entity-only fields apply, it cannot be mislabelled by a caller, and it
+     * still classifies correctly for KYC rows written before the caller sent the right kycType.
+     */
+    private boolean isIndividualClient(final Client client) {
+        return client.getLegalForm() == null || !LegalForm.fromInt(client.getLegalForm()).isEntity();
+    }
+
     /**
      * CIN, GSTIN and incorporation-date columns on m_client_kyc are only meaningful
      * for NON_INDIVIDUAL clients. Reject any request that tries to set them on an
@@ -976,11 +1022,10 @@ public class ClientKycWritePlatformServiceJpaRepositoryImpl implements ClientKyc
         final ClientKyc kyc = kycRepositoryWrapper.findByClientIdWithNotFoundDetection(client.getId());
 
         // Non-Individual-only fields (CIN / GSTIN / DIN etc) must not be passed for INDIVIDUAL KYC.
-        final boolean isIndividualExisting = kyc.getKycType() != null && kyc.getKycType().isIndividual();
         final JsonElement parsedJson = this.fromApiJsonHelper.parse(kycJson);
         final JsonCommand jsonCommand = JsonCommand.from(kycJson, parsedJson, this.fromApiJsonHelper,
                 "CLIENTKYC", null, null, null, client.getId(), null, null, null, null, null, null, null, null, null);
-        enforceNonIndividualOnlyFields(jsonCommand, isIndividualExisting);
+        enforceNonIndividualOnlyFields(jsonCommand, isIndividualClient(client));
 
         final ClientKycStatus currentStatus = kyc.getKycStatus();
         final Map<String, Object> changes = kyc.update(jsonCommand);

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientReadPlatformServiceImpl.java

@@ -79,10 +79,13 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService
     private final ClientLookupMapper lookupMapper = new ClientLookupMapper();
     private final ClientMembersOfGroupMapper membersOfGroupMapper = new ClientMembersOfGroupMapper();
     private final ParentGroupsMapper clientGroupsMapper = new ParentGroupsMapper();
+    private final ClientNonPersonDataMapper clientNonPersonMapper = new ClientNonPersonDataMapper();
 
     private final ColumnValidator columnValidator;
     private final ClientCollateralManagementRepositoryWrapper clientCollateralManagementRepositoryWrapper;
     private final ClientRepositoryWrapper clientRepositoryWrapper;
+    private final org.apache.fineract.portfolio.mobilelookup.service.MobileLookupService mobileLookupService;
+    private final org.apache.fineract.portfolio.sanctions.service.SanctionsScreeningService sanctionsScreeningService;
     private final ClientMapper clientMapper;
 
     @Override
@@ -227,6 +230,24 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService
             final Client client = clientRepositoryWrapper.getClientByClientIdAndHierarchy(clientId, hierarchySearchString);
             final ClientData clientData = clientMapper.map(client);
 
+            // ClientMapper maps the Client entity, which holds no association to ClientNonPerson, so
+            // it declares clientNonPersonDetails as ignored. Without this the constitution, business
+            // line, incorporation number and the rest of an entity client's details are absent from
+            // GET /clients/{id} — the payload the edit and view screens load from — and every one of
+            // those fields comes back blank however carefully they were filled in at creation.
+            clientData.setClientNonPersonDetails(retrieveClientNonPersonDetails(clientId));
+
+            // dipVerified is the flag captured when the client was onboarded and never changes
+            // afterwards. Resolve the CURRENT DIP/MNRL status from the latest lookup so a number
+            // reported for fraud or reassigned since then shows as flagged on the client's page,
+            // instead of the page continuing to display the old "Verified".
+            clientData.setDipLiveStatus(this.mobileLookupService.getLatestStatus(client.getMobileNo()));
+            clientData.setAlternateDipLiveStatus(this.mobileLookupService.getLatestStatus(client.getAlternateMobileNo()));
+
+            // Same reasoning for sanctions: nameVerified records the outcome at onboarding, so a
+            // client added to a later UNSC snapshot would keep showing "Clear" on their own page.
+            clientData.setSanctionsAlertStatus(this.sanctionsScreeningService.getLatestAlertStatus(clientId));
+
             // Get client collaterals
             final Collection<ClientCollateralManagement> clientCollateralManagements = this.clientCollateralManagementRepositoryWrapper
                     .getCollateralsPerClient(clientId);
@@ -254,6 +275,57 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService
         }
     }
 
+    /**
+     * The entity-only block of a client, or null for an individual (or an entity whose details row
+     * was never written). Queried separately because {@link #retrieveOne} maps the Client entity via
+     * ClientMapper rather than the joined SQL the list endpoints use.
+     */
+    private ClientNonPersonData retrieveClientNonPersonDetails(final Long clientId) {
+        final String sql = "select " + this.clientNonPersonMapper.schema();
+        final List<ClientNonPersonData> details = this.jdbcTemplate.query(sql, this.clientNonPersonMapper, // NOSONAR
+                clientId);
+        return details.isEmpty() ? null : details.get(0);
+    }
+
+    private static final class ClientNonPersonDataMapper implements RowMapper<ClientNonPersonData> {
+
+        public String schema() {
+            return " cnp.constitution_cv_id as constitutionId, cvConstitution.code_value as constitutionValue,"
+                    + " cnp.incorp_no as incorpNo, cnp.incorp_validity_till as incorpValidityTill,"
+                    + " cnp.main_business_line_cv_id as mainBusinessLineId,"
+                    + " cvMainBusinessLine.code_value as mainBusinessLineValue, cnp.remarks as remarks,"
+                    + " cnp.authorized_signatory as authorizedSignatory,"
+                    + " cnp.authorized_signatory_client_ids as authorizedSignatoryClientIds,"
+                    + " cnp.additional_info as additionalInfo,"
+                    + " cnp.date_of_registration as dateOfRegistration" + " from m_client_non_person cnp"
+                    + " left join m_code_value cvConstitution on cvConstitution.id = cnp.constitution_cv_id"
+                    + " left join m_code_value cvMainBusinessLine on cvMainBusinessLine.id = cnp.main_business_line_cv_id"
+                    + " where cnp.client_id = ?";
+        }
+
+        @Override
+        public ClientNonPersonData mapRow(final ResultSet rs, final int rowNum) throws SQLException {
+            final Long constitutionId = JdbcSupport.getLong(rs, "constitutionId");
+            final String constitutionValue = rs.getString("constitutionValue");
+            final CodeValueData constitution = CodeValueData.instance(constitutionId, constitutionValue);
+
+            final Long mainBusinessLineId = JdbcSupport.getLong(rs, "mainBusinessLineId");
+            final String mainBusinessLineValue = rs.getString("mainBusinessLineValue");
+            final CodeValueData mainBusinessLine = CodeValueData.instance(mainBusinessLineId, mainBusinessLineValue);
+
+            final String incorpNo = rs.getString("incorpNo");
+            final LocalDate incorpValidityTill = JdbcSupport.getLocalDate(rs, "incorpValidityTill");
+            final String remarks = rs.getString("remarks");
+            final String authorizedSignatory = rs.getString("authorizedSignatory");
+            final String authorizedSignatoryClientIds = rs.getString("authorizedSignatoryClientIds");
+            final String additionalInfo = rs.getString("additionalInfo");
+            final LocalDate dateOfRegistration = JdbcSupport.getLocalDate(rs, "dateOfRegistration");
+
+            return new ClientNonPersonData(constitution, incorpNo, incorpValidityTill, mainBusinessLine, remarks,
+                    authorizedSignatory, additionalInfo, dateOfRegistration, authorizedSignatoryClientIds);
+        }
+    }
+
     @Override
     public Collection<ClientData> retrieveAllForLookup(final String extraCriteria) {
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java

@@ -44,6 +44,7 @@ import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.infrastructure.core.domain.ExternalId;
 import org.apache.fineract.infrastructure.core.exception.ErrorHandler;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
 import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
 import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
@@ -134,6 +135,8 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
     private final ClientRepository clientJpaRepository;
     private final org.apache.fineract.portfolio.mobilelookup.domain.MobileLookupLogRepository mobileLookupLogRepository;
     private final org.apache.fineract.portfolio.sanctions.domain.SanctionsScreeningLogRepository sanctionsScreeningLogRepository;
+    private final org.apache.fineract.portfolio.sanctions.service.SanctionsScreeningService sanctionsScreeningService;
+    private final org.apache.fineract.portfolio.mobilelookup.service.MobileLookupService mobileLookupService;
     private final CifNumberGenerator cifNumberGenerator;
     private final ClientContactOtpService clientContactOtpService;
     private final ClientChangeNotificationService clientChangeNotificationService;
@@ -156,6 +159,13 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
                 this.clientNonPersonRepository.delete(clientNonPerson);
             }
 
+            // Safely cascade-delete child records that have foreign keys pointing to this client
+            this.jdbcTemplate.update("delete from m_client_identifier where client_id = ?", clientId);
+            this.jdbcTemplate.update("delete from m_family_members where client_id = ?", clientId);
+            this.jdbcTemplate.update("delete from m_client_address where client_id = ?", clientId);
+            this.jdbcTemplate.update("delete from m_address where client_id = ?", clientId);
+            this.jdbcTemplate.update("delete from m_client_kyc where client_id = ?", clientId);
+
             this.clientRepository.delete(client);
             this.clientRepository.flush();
             return new CommandProcessingResultBuilder() //
@@ -611,6 +621,18 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
                 newClient.setScreeningLogId(screeningLogId);
             }
 
+            // UNSC sanctions gate. The UI disables Save & Next on a match, but that is a browser
+            // control only — screen server-side too, so a direct API call cannot onboard a listed
+            // person. The name is cleared only by a false positive the Principal Officer approved.
+            validateNotSanctioned(newClient.getDisplayName());
+
+            // DIP/MNRL gate — same reasoning: dipVerified arrives from the browser and cannot be
+            // trusted on its own. Record the status actually on file alongside it.
+            validateMobileNumberUsable(newClient.getMobileNo(), "mobileNo");
+            validateMobileNumberUsable(newClient.getAlternateMobileNo(), "alternateMobileNo");
+            newClient.setDipStatus(this.mobileLookupService.getLatestStatus(newClient.getMobileNo()));
+            newClient.setAlternateDipStatus(this.mobileLookupService.getLatestStatus(newClient.getAlternateMobileNo()));
+
             // Account Number generation
             this.clientRepository.saveAndFlush(newClient);
             if (StringUtils.isBlank(accountNo)) {
@@ -756,6 +778,8 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
 
             final String authorizedSignatory = this.fromApiJsonHelper
                     .extractStringNamed(ClientApiConstants.authorizedSignatoryParamName, clientNonPersonElement);
+            final String authorizedSignatoryClientIds = this.fromApiJsonHelper
+                    .extractStringNamed(ClientApiConstants.authorizedSignatoryClientIdsParamName, clientNonPersonElement);
             final String additionalInfo = this.fromApiJsonHelper.extractStringNamed(ClientApiConstants.additionalInfoParamName,
                     clientNonPersonElement);
             final LocalDate dateOfRegistration = this.fromApiJsonHelper
@@ -763,7 +787,7 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
 
             final ClientNonPerson newClientNonPerson = ClientNonPerson.createNew(client, clientNonPersonConstitution,
                     clientNonPersonMainBusinessLine, incorpNumber, incorpValidityTill, remarks, authorizedSignatory, additionalInfo,
-                    dateOfRegistration);
+                    dateOfRegistration, authorizedSignatoryClientIds);
 
             this.clientNonPersonRepository.save(newClientNonPerson);
         }
@@ -884,12 +908,18 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
                 oldMobileNoForNotification = oldValue;
                 newMobileNoForNotification = newValue;
                 mobileNoChanged = true;
+                // Replacing the number IS the resolution for a DIP/MNRL hit, so close the open
+                // alert here. Left to the officer as a second manual step it would be forgotten,
+                // and the queue would fill with cases that were in fact already dealt with.
+                closeDipAlertForReplacedNumber(oldValue, newValue, clientId);
             }
 
             if (command.isChangeInStringParameterNamed(ClientApiConstants.alternateMobileNoParamName, clientForUpdate.getAlternateMobileNo())) {
                 final String newValue = command.stringValueOfParameterNamed(ClientApiConstants.alternateMobileNoParamName);
+                final String oldAlternate = clientForUpdate.getAlternateMobileNo();
                 changes.put(ClientApiConstants.alternateMobileNoParamName, newValue);
                 clientForUpdate.setAlternateMobileNo(StringUtils.defaultIfEmpty(newValue, null));
+                closeDipAlertForReplacedNumber(oldAlternate, newValue, clientId);
             }
 
             if (command.isChangeInStringParameterNamed(ClientApiConstants.emailAddressParamName, clientForUpdate.getEmailAddress())) {
@@ -1700,6 +1730,82 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
     /*
      * To become a part of a group, group may have set of criteria to be m et before client can become member of it.
      */
+    /**
+     * Refuses onboarding of a name that hits the UN Security Council consolidated list.
+     *
+     * <p>
+     * Applies equally to individuals and non-individuals — the display name covers both, and the
+     * list itself holds INDIVIDUAL and ENTITY records. The only way past this is a false positive
+     * on the same name that the Principal Officer has approved, which is deliberately a different
+     * person's decision from the officer who reviewed the hit.
+     * </p>
+     */
+    private void validateNotSanctioned(final String displayName) {
+        if (StringUtils.isBlank(displayName)) {
+            return;
+        }
+        if (this.sanctionsScreeningService.hasApprovedFalsePositive(displayName)) {
+            return;
+        }
+        // Non-logging check on purpose — see SanctionsScreeningService#isNameSanctioned.
+        if (this.sanctionsScreeningService.isNameSanctioned(displayName)) {
+            throw new GeneralPlatformDomainRuleException("error.msg.client.sanctions.match",
+                    "'" + displayName + "' matched the UN Security Council Consolidated List. Onboarding is blocked until the "
+                            + "Principal Officer clears the alert.",
+                    displayName);
+        }
+    }
+
+    /**
+     * Refuses a mobile number that the DoT Digital Intelligence Platform flagged, unless an
+     * officer explicitly recorded a decision to proceed with a written reason.
+     *
+     * <p>
+     * A number with no lookup on record passes: DIP verification is enforced in the onboarding
+     * flow, and failing here would block every legacy update that merely touches an old client.
+     * What this stops is the case that matters — a number the DoT has actively flagged being
+     * saved because the browser said it was fine.
+     * </p>
+     */
+    /**
+     * Closes any open DIP/MNRL alert on a number that has just been replaced.
+     *
+     * <p>
+     * For an existing customer a flagged number is resolved by obtaining a new one — at which
+     * point the old alert describes a number the bank no longer uses. Closing it here keeps the
+     * decision queue a list of work actually outstanding rather than a growing pile of cases that
+     * were already handled. Failure is logged, never propagated: the client update itself must
+     * not fail because a bookkeeping row could not be stamped.
+     * </p>
+     */
+    private void closeDipAlertForReplacedNumber(final String oldNumber, final String newNumber, final Long clientId) {
+        if (StringUtils.isBlank(oldNumber) || StringUtils.equals(oldNumber, newNumber)) {
+            return;
+        }
+        try {
+            final String reason = StringUtils.isBlank(newNumber)
+                    ? "Number removed from the client record on resolution of the DIP/MNRL alert."
+                    : "Number replaced with " + newNumber + " on resolution of the DIP/MNRL alert.";
+            this.mobileLookupService.closeOpenAlerts(oldNumber.trim(), clientId, reason);
+        } catch (Exception e) {
+            log.error("Could not close DIP alert for replaced number {} on client {}: {}", oldNumber, clientId,
+                    e.getMessage());
+        }
+    }
+
+    private void validateMobileNumberUsable(final String mobileNo, final String parameter) {
+        if (StringUtils.isBlank(mobileNo)) {
+            return;
+        }
+        if (this.mobileLookupService.isMobileNumberUsable(mobileNo.trim())) {
+            return;
+        }
+        throw new GeneralPlatformDomainRuleException("error.msg.client.mobile.dip.flagged",
+                "Mobile number " + mobileNo + " is flagged on the DoT Digital Intelligence Platform. Record a decision "
+                        + "to proceed, with reasons, before saving this client.",
+                parameter);
+    }
+
     private void validateParentGroupRulesBeforeClientActivation(Client client) {
         Integer minNumberOfClients = configurationDomainService.retrieveMinAllowedClientsInGroup();
         Integer maxNumberOfClients = configurationDomainService.retrieveMaxAllowedClientsInGroup();

fineract-provider/src/main/java/org/apache/fineract/portfolio/dividenddashboard/api/DividendClaimRequestApiResource.java

@@ -37,9 +37,11 @@ import jakarta.ws.rs.WebApplicationException;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import java.math.BigDecimal;
+import java.math.RoundingMode;
 import java.sql.Timestamp;
 import java.time.Instant;
 import java.time.LocalDate;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import lombok.RequiredArgsConstructor;
@@ -69,13 +71,19 @@ import org.springframework.transaction.annotation.Transactional;
  * repayment/deposit command (so loan schedules and savings ledgers stay fully native and correct),
  * which debits whatever GL account is actually configured as that product's Fund Source -- not
  * necessarily Cash at Main Vault (e.g. a Loan-Against-Warehouse-Receipt product debits its own
- * "Warehouse Receipt" account instead). Since the money never actually came from that account, an
+ * "Warehouse Receipt" account instead). Since the money never actually came from that account,
- * immediate manual journal entry (Dr Dividend Payable / Cr whichever account was actually debited
+ * that same DEBIT leg is rewritten in place to Dividend Payable (see
- * -- read straight off the GL entry the native command just posted) replenishes it for that same
+ * {@code redirectFundSourceDebitToDividendPayable}) rather than reversed with a second manual
- * amount, so the net effect is exactly "Dividend Payable decreases, loan/savings changes, that
+ * entry pair, so the transaction ends up with exactly the entries a real accountant would expect
- * fund-source account is untouched". The cash leg has no account to post through, so it's a direct
+ * -- Dividend Payable debited, Loan Portfolio/Income or Savings credited, nothing else touched --
- * manual entry only (Dr Dividend Payable / Cr Cash at Main Vault) -- real cash leaves the vault
+ * instead of that fund-source account confusingly appearing twice. The cash leg has no account to
- * into the member's hand.
+ * post through, so approval
+ * posts a direct manual entry (Dr Dividend Payable / Cr Cash at Main Vault) immediately -- but the
+ * physical hand-over is deferred: the claim's {@code cash_status} becomes
+ * {@code AWAITING_DISBURSEMENT} and the clerk-supplied token number ({@code tok_no}) must be
+ * redeemed by a cashier at Transaction Entry (see {@code getByToken}/{@code disburse} below) before
+ * the money is actually handed over, exactly mirroring {@code ClerkWithdrawalRequestApiResource}'s
+ * submit/approve/disburse token flow for ordinary savings withdrawals.
  */
 @Path("/v1/clerk/dividend-claim-requests")
 @Component
@@ -96,8 +104,9 @@ public class DividendClaimRequestApiResource {
     private static final String[] LIST_COLUMNS = { "r.id", "r.lock_id", "r.client_id", "c.display_name AS client_name",
             "r.savings_account_id", "sav.account_no AS savings_account_no", "r.loan_id",
             "(SELECT account_no FROM m_loan WHERE id = r.loan_id) AS loan_account_no", "r.loan_apply_amount",
-            "r.savings_apply_amount", "r.cash_apply_amount", "l.amount AS locked_amount", "l.release_due_date", "r.status", "r.clerk_id",
+            "r.savings_apply_amount", "r.cash_apply_amount", "r.tok_no", "r.cash_status", "l.amount AS locked_amount",
-            "r.clerk_name", "r.manager_id", "r.manager_name", "r.rejection_reason", "r.submitted_at", "r.actioned_at" };
+            "l.release_due_date", "r.status", "r.clerk_id", "r.clerk_name", "r.manager_id", "r.manager_name", "r.rejection_reason",
+            "r.submitted_at", "r.actioned_at" };
 
     // ── GET /v1/clerk/dividend-claim-requests/overdue-loans/{clientId} ──────────
 
@@ -142,7 +151,14 @@ public class DividendClaimRequestApiResource {
         final Long savingsAccountIdOverride = fromJsonHelper.extractLongNamed("savingsAccountId", root);
         final BigDecimal loanApplyAmount = parseAmount(fromJsonHelper.extractStringNamed("loanApplyAmount", root));
         final BigDecimal savingsApplyAmount = parseAmount(fromJsonHelper.extractStringNamed("savingsApplyAmount", root));
-        final BigDecimal cashApplyAmount = parseAmount(fromJsonHelper.extractStringNamed("cashApplyAmount", root));
+        // Cash can only be handed over in whole-rupee notes/coins (no denomination below ₹1),
+        // while a dividend share often works out to paise -- floor to the nearest rupee (never
+        // trusting the frontend to have already done so) so the denomination breakdown the
+        // cashier counts at disburse time can always match exactly; any leftover paise is simply
+        // not claimed here and stays part of the lock's balance for a future claim.
+        final BigDecimal cashApplyAmount = parseAmount(fromJsonHelper.extractStringNamed("cashApplyAmount", root))
+                .setScale(0, RoundingMode.FLOOR);
+        final String tokNo = fromJsonHelper.extractStringNamed("tokNo", root);
         if (lockId == null) {
             throw apiError(400, "lockId is required");
         }
@@ -197,6 +213,13 @@ public class DividendClaimRequestApiResource {
             }
         }
 
+        if (cashApplyAmount.compareTo(BigDecimal.ZERO) > 0) {
+            if (tokNo == null || tokNo.isBlank()) {
+                throw apiError(400, "Token number (TOK. NO.) is required when cashApplyAmount is greater than zero");
+            }
+            validateTokenUniqueToday(tokNo, null);
+        }
+
         final Long existingPending = jdbcTemplate.queryForObject(
                 "SELECT COUNT(*) FROM m_share_dividend_claim_request WHERE lock_id = ? AND status = 'PENDING'", Long.class, lockId);
         if (existingPending != null && existingPending > 0) {
@@ -206,15 +229,39 @@ public class DividendClaimRequestApiResource {
         final Long newId = jdbcTemplate.queryForObject("""
                 INSERT INTO m_share_dividend_claim_request
                     (lock_id, client_id, savings_account_id, requested_amount, loan_id, loan_apply_amount, savings_apply_amount,
-                     cash_apply_amount, status, clerk_id, clerk_name, submitted_at)
+                     cash_apply_amount, status, clerk_id, clerk_name, submitted_at, tok_no)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'PENDING', ?, ?, ?)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'PENDING', ?, ?, ?, ?)
                 RETURNING id
                 """, Long.class, lockId, clientId, resolvedSavingsAccountId, total, loanId, loanApplyAmount, savingsApplyAmount,
-                cashApplyAmount, currentUser.getId(), currentUser.getDisplayName(), Timestamp.from(Instant.now()));
+                cashApplyAmount, currentUser.getId(), currentUser.getDisplayName(), Timestamp.from(Instant.now()),
+                cashApplyAmount.compareTo(BigDecimal.ZERO) > 0 ? tokNo : null);
 
         return gson.toJson(Map.of("resourceId", newId, "status", "PENDING"));
     }
 
+    /**
+     * Ensures the token number is unique for today's date across both this table and
+     * {@code m_clerk_withdrawal_request} -- cashiers type either kind of token into the same
+     * Transaction Entry field, so the two pools must never collide.
+     */
+    private void validateTokenUniqueToday(final String tokNo, final Long excludeId) {
+        final StringBuilder sql = new StringBuilder("SELECT COUNT(*) FROM m_share_dividend_claim_request "
+                + "WHERE tok_no = ? AND CAST(submitted_at AS DATE) = CURRENT_DATE AND status <> 'REJECTED'");
+        final List<Object> params = new ArrayList<>();
+        params.add(tokNo);
+        if (excludeId != null) {
+            sql.append(" AND id <> ?");
+            params.add(excludeId);
+        }
+        final Long ownCount = jdbcTemplate.queryForObject(sql.toString(), Long.class, params.toArray());
+        final Long otherCount = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_clerk_withdrawal_request "
+                + "WHERE tok_no = ? AND CAST(submitted_at AS DATE) = CURRENT_DATE AND status <> 'REJECTED'", Long.class, tokNo);
+        final long total = (ownCount == null ? 0 : ownCount) + (otherCount == null ? 0 : otherCount);
+        if (total > 0) {
+            throw apiError(400, "Token number '" + tokNo + "' is already used today. Please enter a different token number.");
+        }
+    }
+
     private BigDecimal parseAmount(final String value) {
         if (value == null || value.isBlank()) {
             return BigDecimal.ZERO;
@@ -312,8 +359,7 @@ public class DividendClaimRequestApiResource {
             final CommandWrapper repaymentCommand = new CommandWrapperBuilder().loanRepaymentTransaction(loanId)
                     .withJson(payload.toString()).build();
             final CommandProcessingResult repaymentResult = commandsSourceWritePlatformService.logCommandSource(repaymentCommand);
-            final Long fundSourceAccountId = resolveDebitAccountForLoanTransaction(repaymentResult.getResourceId());
+            redirectFundSourceDebitToDividendPayable(repaymentResult.getResourceId(), null);
-            replenishFundSourceFromDividendPayable(id, currencyCode, loanApplyAmount, today, fundSourceAccountId);
         }
 
         if (savingsApplyAmount.compareTo(BigDecimal.ZERO) > 0) {
@@ -323,12 +369,12 @@ public class DividendClaimRequestApiResource {
             payload.addProperty("transactionDate", today.toString());
             payload.addProperty("transactionAmount", savingsApplyAmount);
             payload.addProperty("note", note);
+            payload.addProperty("paymentTypeId", resolveDividendClaimPaymentTypeId());
             final Long savingsAccountId = ((Number) claimSavingsAccountId).longValue();
             final CommandWrapper depositCommand = new CommandWrapperBuilder().savingsAccountDeposit(savingsAccountId)
                     .withJson(payload.toString()).build();
             final CommandProcessingResult depositResult = commandsSourceWritePlatformService.logCommandSource(depositCommand);
-            final Long fundSourceAccountId = resolveDebitAccountForSavingsTransaction(depositResult.getResourceId());
+            redirectFundSourceDebitToDividendPayable(null, depositResult.getResourceId());
-            replenishFundSourceFromDividendPayable(id, currencyCode, savingsApplyAmount, today, fundSourceAccountId);
         }
 
         if (cashApplyAmount.compareTo(BigDecimal.ZERO) > 0) {
@@ -343,10 +389,12 @@ public class DividendClaimRequestApiResource {
             jdbcTemplate.update("UPDATE m_share_dividend_lock SET status = 'CLAIMED', last_modified_date = now() WHERE id = ?", lockId);
         }
 
+        final String cashStatus = cashApplyAmount.compareTo(BigDecimal.ZERO) > 0 ? "AWAITING_DISBURSEMENT" : null;
         jdbcTemplate.update("""
-                UPDATE m_share_dividend_claim_request SET status = 'APPROVED', manager_id = ?, manager_name = ?, actioned_at = ?
+                UPDATE m_share_dividend_claim_request SET status = 'APPROVED', manager_id = ?, manager_name = ?, actioned_at = ?,
+                       cash_status = ?
                 WHERE id = ? AND status = 'PENDING'
-                """, currentUser.getId(), currentUser.getDisplayName(), Timestamp.from(Instant.now()), id);
+                """, currentUser.getId(), currentUser.getDisplayName(), Timestamp.from(Instant.now()), cashStatus, id);
 
         final JsonObject response = new JsonObject();
         response.addProperty("resourceId", id);
@@ -356,60 +404,261 @@ public class DividendClaimRequestApiResource {
         return gson.toJson(response);
     }
 
+    // ── GET /v1/clerk/dividend-claim-requests/by-token/{token} ── Cashier token lookup ──
+
     /**
-     * Which GL account a loan repayment or savings deposit's cash/fund-source leg actually debits
+     * Mirrors {@code ClerkWithdrawalRequestApiResource.getByToken} -- a cashier at Transaction
-     * is a per-product (sometimes per-payment-type) configuration choice, not always literally
+     * Entry types the clerk-supplied token number here to resolve the approved cash amount before
-     * "Cash at Main Vault" -- e.g. a Loan-Against-Warehouse-Receipt product debits its own
+     * disbursing it, instead of the manager handing over cash directly at approval time.
-     * "Warehouse Receipt" account instead. Rather than assume, these read the actual GL entry the
-     * native command just posted for this transaction and return whichever account it debited.
      */
-    private Long resolveDebitAccountForLoanTransaction(final Long loanTransactionId) {
+    @GET
-        return jdbcTemplate
+    @Path("/by-token/{token}")
-                .queryForList("SELECT account_id FROM acc_gl_journal_entry WHERE loan_transaction_id = ? AND type_enum = ?", Long.class,
+    @Produces(MediaType.APPLICATION_JSON)
-                        loanTransactionId, JOURNAL_ENTRY_TYPE_DEBIT)
+    public String getByToken(@PathParam("token") final String token) {
-                .stream().findFirst().orElse(null);
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("""
+                SELECT r.id, r.client_id, c.display_name AS client_name, r.cash_apply_amount AS amount,
+                       r.tok_no, r.status, r.cash_status, r.submitted_at, r.actioned_at
+                FROM m_share_dividend_claim_request r
+                JOIN m_client c ON c.id = r.client_id
+                WHERE r.tok_no = ? AND CAST(r.submitted_at AS DATE) = CURRENT_DATE
+                ORDER BY r.submitted_at DESC LIMIT 1
+                """, token);
+
+        if (rows.isEmpty()) {
+            throw apiError(404, "Token '" + token + "' not found for today. Please check the token number.");
+        }
+
+        final Map<String, Object> row = rows.get(0);
+        final String status = String.valueOf(row.get("status"));
+        final String cashStatus = row.get("cash_status") == null ? null : String.valueOf(row.get("cash_status"));
+
+        if ("PENDING".equals(status)) {
+            throw apiError(422, "Token '" + token + "' is still PENDING — manager has not approved this claim yet.");
+        }
+        if ("REJECTED".equals(status)) {
+            throw apiError(422, "Token '" + token + "' was REJECTED by the manager. This claim cannot be processed.");
+        }
+        if (!"APPROVED".equals(status)) {
+            throw apiError(422, "Token '" + token + "' has unexpected status: " + status);
+        }
+        if ("DISBURSED".equals(cashStatus)) {
+            throw apiError(422, "Token '" + token + "' has already been withdrawn. Cash was handed over by another cashier.");
+        }
+        if (!"AWAITING_DISBURSEMENT".equals(cashStatus)) {
+            throw apiError(422, "Token '" + token + "' has no cash portion awaiting disbursement.");
+        }
+        return gson.toJson(row);
     }
 
-    private Long resolveDebitAccountForSavingsTransaction(final Long savingsTransactionId) {
+    // ── POST /v1/clerk/dividend-claim-requests/{id}/disburse ── Cashier confirms cash hand-over ──
-        return jdbcTemplate
+
-                .queryForList("SELECT account_id FROM acc_gl_journal_entry WHERE savings_transaction_id = ? AND type_enum = ?",
+    /**
-                        Long.class, savingsTransactionId, JOURNAL_ENTRY_TYPE_DEBIT)
+     * Mirrors {@code ClerkWithdrawalRequestApiResource.disburse} -- the GL entry already posted at
-                .stream().findFirst().orElse(null);
+     * approve time, so this step is purely a physical-cash-handover record with double-disbursement
+     * protection ({@code WHERE cash_status = 'AWAITING_DISBURSEMENT'}), never a new transaction.
+     */
+    @POST
+    @Path("/{id}/disburse")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Transactional
+    public String disburse(@PathParam("id") final Long id, final String body) {
+        final AppUser currentUser = context.authenticatedUser();
+        final Map<String, Object> record = jdbcTemplate
+                .queryForList("SELECT id, lock_id, client_id, cash_apply_amount, cash_status FROM m_share_dividend_claim_request WHERE id = ?",
+                        id)
+                .stream().findFirst().orElseThrow(() -> new NotFoundException("Dividend claim request not found: " + id));
+
+        final String cashStatus = record.get("cash_status") == null ? null : String.valueOf(record.get("cash_status"));
+        if (!"AWAITING_DISBURSEMENT".equals(cashStatus)) {
+            throw apiError(409, "Only claims AWAITING_DISBURSEMENT can be disbursed. Current cash status: " + cashStatus);
+        }
+
+        String denominationData = null;
+        BigDecimal transactionAmount = null;
+        if (body != null && !body.isBlank()) {
+            final JsonElement root = fromJsonHelper.parse(body);
+            denominationData = fromJsonHelper.extractStringNamed("denominationData", root);
+            transactionAmount = parseAmount(fromJsonHelper.extractStringNamed("transactionAmount", root));
+        }
+        if (transactionAmount == null || transactionAmount.compareTo(BigDecimal.ZERO) <= 0) {
+            throw apiError(400, "transactionAmount is required and must be greater than zero for disbursement.");
+        }
+
+        // cash_apply_amount is floored to whole rupees at submit time now (see submit() above),
+        // but a claim created before that fix may still carry paise -- floor here too so an older
+        // claim can still be disbursed in whole-rupee cash rather than being stuck forever.
+        final BigDecimal cashApplyAmount = (BigDecimal) record.get("cash_apply_amount");
+        final BigDecimal disbursableAmount = cashApplyAmount.setScale(0, RoundingMode.FLOOR);
+        if (disbursableAmount.compareTo(transactionAmount) != 0) {
+            throw apiError(400, "Transaction amount " + transactionAmount + " does not match the claim's disbursable cash amount of "
+                    + disbursableAmount + " (cash can only be handed over in whole rupees).");
+        }
+
+        final long denomTotal = denominationTotal(denominationData);
+        if (denomTotal > 0 && BigDecimal.valueOf(denomTotal).compareTo(transactionAmount) != 0) {
+            throw apiError(400,
+                    "Cash denomination total " + denomTotal + " does not match disbursement amount " + transactionAmount);
+        }
+
+        final int updated = jdbcTemplate.update("""
+                UPDATE m_share_dividend_claim_request SET
+                    cash_status = 'DISBURSED', cashier_id = ?, disbursed_by = ?, disbursement_denomination_data = ?, disbursed_at = ?
+                WHERE id = ? AND cash_status = 'AWAITING_DISBURSEMENT'
+                """, currentUser.getId(), currentUser.getDisplayName(), denominationData, Timestamp.from(Instant.now()), id);
+
+        if (updated == 0) {
+            throw apiError(409, "This dividend cash claim has already been withdrawn by another cashier. Double disbursement prevented.");
+        }
+
+        if (denominationData != null && !denominationData.isBlank()) {
+            final Long clientId = ((Number) record.get("client_id")).longValue();
+            final Long lockId = ((Number) record.get("lock_id")).longValue();
+            saveDisbursementDenomination(id, clientId, lockId, denominationData, currentUser);
+        }
+
+        return gson.toJson(Map.of("resourceId", id, "status", "DISBURSED"));
+    }
+
+    /** Sums a {"note:500": 2, "coin:1": 10} breakdown; 0 when absent or empty. */
+    private long denominationTotal(final String denominationData) {
+        if (denominationData == null || denominationData.isBlank()) {
+            return 0;
+        }
+        final JsonObject denomMap;
+        try {
+            denomMap = gson.fromJson(denominationData, JsonObject.class);
+        } catch (final Exception e) {
+            throw apiError(400, "denominationData is not valid JSON");
+        }
+        if (denomMap == null) {
+            return 0;
+        }
+        long total = 0;
+        for (final Map.Entry<String, JsonElement> entry : denomMap.entrySet()) {
+            final String[] parts = entry.getKey().split(":", 2);
+            if (parts.length != 2) {
+                continue;
+            }
+            final int value;
+            final int count;
+            try {
+                value = Integer.parseInt(parts[1]);
+                count = entry.getValue().getAsInt();
+            } catch (final Exception e) {
+                continue;
+            }
+            if (count > 0) {
+                total += (long) value * count;
+            }
+        }
+        return total;
     }
 
     /**
-     * The loan repayment / savings deposit just posted above assumed the money came out of
+     * Records the cashier's note/coin breakdown for a dividend cash disbursement into
-     * whichever account is that product's actual Fund Source -- it didn't really. This puts that
+     * {@code m_savings_txn_denomination} for vault-position reporting. There is no native savings
-     * fund straight back, sourced from the Dividend Payable liability instead, so the net effect
+     * transaction backing this (the cash leg is a pure GL entry posted at approve time), so this
-     * is exactly "liability shrinks, the loan/savings account changes, that fund-source account is
+     * claim request's own id is used as the stable txn identifier for grouping.
-     * unaffected". Skipped (loan/savings still updated) if the bank hasn't mapped the Dividend
-     * Payable financial activity, or if the command's own debit leg couldn't be found.
      */
-    private void replenishFundSourceFromDividendPayable(final Long claimRequestId, final String currencyCode, final BigDecimal amount,
+    private void saveDisbursementDenomination(final Long claimRequestId, final Long clientId, final Long lockId,
-            final LocalDate entryDate, final Long fundSourceAccountId) {
+            final String denominationData, final AppUser cashier) {
+        final JsonObject denomMap;
+        try {
+            denomMap = gson.fromJson(denominationData, JsonObject.class);
+        } catch (final Exception e) {
+            return;
+        }
+        if (denomMap == null || denomMap.size() == 0) {
+            return;
+        }
+
+        for (final Map.Entry<String, JsonElement> entry : denomMap.entrySet()) {
+            final int count;
+            try {
+                count = entry.getValue().getAsInt();
+            } catch (final Exception e) {
+                continue;
+            }
+            if (count <= 0) {
+                continue;
+            }
+
+            final String[] parts = entry.getKey().split(":", 2);
+            if (parts.length != 2) {
+                continue;
+            }
+            final String kind = parts[0];
+            final int value;
+            try {
+                value = Integer.parseInt(parts[1]);
+            } catch (final Exception e) {
+                continue;
+            }
+
+            final List<Long> ids = jdbcTemplate.queryForList(
+                    "SELECT id FROM m_denomination_master WHERE denomination = ? AND kind = ? AND (deleted IS NULL OR deleted = false) LIMIT 1",
+                    Long.class, value, kind);
+            if (ids.isEmpty()) {
+                continue;
+            }
+            final Long denomId = ids.get(0);
+
+            jdbcTemplate.update("""
+                    INSERT INTO m_savings_txn_denomination
+                    (txn_id, savings_account_id, account_no, client_id, denomination_id,
+                     denomination_value, count, total_amount, txn_date, txn_type, officer_id, officer_username)
+                    VALUES (?, NULL, ?, ?, ?, ?, ?, ?, CURRENT_DATE, 'WITHDRAWAL', ?, ?)
+                    """, claimRequestId, "DIVIDEND-" + lockId, clientId, denomId, value, count,
+                    BigDecimal.valueOf((long) value * count), cashier.getId(), cashier.getUsername());
+        }
+    }
+
+    /**
+     * Fineract's savings deposit command mandates paymentTypeId even for an internal posting with
+     * no real customer payment instrument -- resolves the system-seeded "Dividend Claim
+     * Settlement" payment type (see migration 0464) rather than hardcoding a numeric id, which
+     * would break on any tenant seeded differently.
+     */
+    private Long resolveDividendClaimPaymentTypeId() {
+        final Long paymentTypeId = jdbcTemplate
+                .queryForList("SELECT id FROM m_payment_type WHERE code_name = 'DIVIDEND_CLAIM_SETTLEMENT'", Long.class).stream()
+                .findFirst().orElse(null);
+        if (paymentTypeId == null) {
+            throw apiError(500, "Payment type 'DIVIDEND_CLAIM_SETTLEMENT' is not seeded -- run the latest database migrations.");
+        }
+        return paymentTypeId;
+    }
+
+    /**
+     * The loan repayment / savings deposit command just posted its own native GL entries assuming
+     * the money came out of whichever account is that product's actual Fund Source (not always
+     * literally "Cash at Main Vault" -- e.g. a Loan-Against-Warehouse-Receipt product debits its
+     * own "Warehouse Receipt" account instead) -- it didn't really. Rather than reverse that with
+     * a second manual entry pair (which would leave that fund-source account appearing twice, once
+     * debited then immediately credited back -- a confusing "wash" no real accountant would post),
+     * this rewrites that same DEBIT leg's account in place to Dividend Payable, so the transaction
+     * ends up with exactly the entries a real accountant would expect: Dividend Payable debited,
+     * Loan Portfolio/Income or Savings credited, nothing else touched. Skipped (loan/savings still
+     * updated) if the bank hasn't mapped the Dividend Payable financial activity. Exactly one of
+     * the two ids is non-null per call.
+     */
+    private void redirectFundSourceDebitToDividendPayable(final Long loanTransactionId, final Long savingsTransactionId) {
         final Long payableDividendsAccountId = jdbcTemplate
                 .queryForList("SELECT gl_account_id FROM acc_gl_financial_activity_account WHERE financial_activity_type = ?", Long.class,
                         FINANCIAL_ACTIVITY_PAYABLE_DIVIDENDS)
                 .stream().findFirst().orElse(null);
-        if (payableDividendsAccountId == null || fundSourceAccountId == null) {
+        if (payableDividendsAccountId == null) {
             return;
         }
-
+        if (loanTransactionId != null) {
-        final AppUser currentUser = context.authenticatedUser();
+            jdbcTemplate.update("UPDATE acc_gl_journal_entry SET account_id = ? WHERE loan_transaction_id = ? AND type_enum = ?",
-        final java.sql.Date sqlEntryDate = java.sql.Date.valueOf(entryDate);
+                    payableDividendsAccountId, loanTransactionId, JOURNAL_ENTRY_TYPE_DEBIT);
-        final String transactionId = "DIVCLAIM" + claimRequestId + "-" + System.nanoTime();
+        }
-        final String description = "Dividend claim #" + claimRequestId + " disbursed";
+        if (savingsTransactionId != null) {
-        final String insertSql = """
+            jdbcTemplate.update("UPDATE acc_gl_journal_entry SET account_id = ? WHERE savings_transaction_id = ? AND type_enum = ?",
-                INSERT INTO acc_gl_journal_entry
+                    payableDividendsAccountId, savingsTransactionId, JOURNAL_ENTRY_TYPE_DEBIT);
-                    (account_id, office_id, currency_code, transaction_id, reversed, manual_entry, entry_date, type_enum, amount,
+        }
-                     description, created_by, last_modified_by, created_date, lastmodified_date, created_on_utc, last_modified_on_utc,
-                     submitted_on_date, transaction_date)
-                VALUES (?, 1, ?, ?, false, true, ?, ?, ?, ?, ?, ?, now(), now(), now(), now(), ?, ?)
-                """;
-        this.jdbcTemplate.update(insertSql, payableDividendsAccountId, currencyCode, transactionId, sqlEntryDate, 2, amount, description,
-                currentUser.getId(), currentUser.getId(), sqlEntryDate, sqlEntryDate);
-        this.jdbcTemplate.update(insertSql, fundSourceAccountId, currencyCode, transactionId, sqlEntryDate, 1, amount, description,
-                currentUser.getId(), currentUser.getId(), sqlEntryDate, sqlEntryDate);
     }
 
     /**

fineract-provider/src/main/java/org/apache/fineract/portfolio/dividenddashboard/api/DividendDashboardApiResource.java

@@ -46,8 +46,6 @@ import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformS
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
-import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
-import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Component;
 import org.springframework.transaction.annotation.Transactional;
@@ -67,7 +65,6 @@ public class DividendDashboardApiResource {
 
     private final JdbcTemplate jdbcTemplate;
     private final FromJsonHelper fromJsonHelper;
-    private final PlatformSecurityContext context;
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
     private final Gson gson = new GsonBuilder().serializeNulls().setDateFormat("yyyy-MM-dd'T'HH:mm:ss").create();
 
@@ -294,8 +291,8 @@ public class DividendDashboardApiResource {
      * pure "Dividend Payable" GL liability until claimed -- see
      * {@code DividendClaimRequestApiResource}), there's no hold to release or account-transfer to
      * make: this posts a native loan repayment (so the loan's own schedule/state stays fully
-     * native and correct) and then replenishes the vault it assumed the cash came from, sourced
+     * native and correct) and then redirects the debit leg it assumed the cash came from to the
-     * instead from the Dividend Payable liability -- identical mechanic to a claim's loan leg.
+     * Dividend Payable liability instead -- identical mechanic to a claim's loan leg.
      */
     @POST
     @Path("/{lockId}/apply-to-loan")
@@ -310,7 +307,6 @@ public class DividendDashboardApiResource {
             throw apiError(409, "This dividend is not currently UNCLAIMED (status: " + lock.get("status") + ")");
         }
         final Long clientId = ((Number) lock.get("client_id")).longValue();
-        final String currencyCode = (String) lock.get("currency_code");
         final BigDecimal unclaimedAmount = (BigDecimal) lock.get("amount");
 
         final JsonElement root = fromJsonHelper.parse(body);
@@ -348,8 +344,7 @@ public class DividendDashboardApiResource {
         final CommandWrapper repaymentCommand = new CommandWrapperBuilder().loanRepaymentTransaction(loanId)
                 .withJson(payload.toString()).build();
         final CommandProcessingResult repaymentResult = commandsSourceWritePlatformService.logCommandSource(repaymentCommand);
-        final Long fundSourceAccountId = resolveDebitAccountForLoanTransaction(repaymentResult.getResourceId());
+        redirectFundSourceDebitToDividendPayable(repaymentResult.getResourceId());
-        replenishFundSourceFromDividendPayable(lockId, currencyCode, applyAmount, today, fundSourceAccountId);
 
         final BigDecimal remainder = unclaimedAmount.subtract(applyAmount);
         if (remainder.compareTo(BigDecimal.ZERO) > 0) {
@@ -370,53 +365,28 @@ public class DividendDashboardApiResource {
         return gson.toJson(response);
     }
 
-    /**
-     * Which GL account a loan repayment's cash/fund-source leg actually debits is a per-product
-     * (sometimes per-payment-type) configuration choice, not always literally "Cash at Main Vault"
-     * -- e.g. a Loan-Against-Warehouse-Receipt product debits its own "Warehouse Receipt" account
-     * instead. Rather than assume, this reads the actual GL entry the native repayment command
-     * just posted for this transaction and returns whichever account it debited.
-     */
-    private Long resolveDebitAccountForLoanTransaction(final Long loanTransactionId) {
-        return jdbcTemplate
-                .queryForList("SELECT account_id FROM acc_gl_journal_entry WHERE loan_transaction_id = ? AND type_enum = ?", Long.class,
-                        loanTransactionId, JOURNAL_ENTRY_TYPE_DEBIT)
-                .stream().findFirst().orElse(null);
-    }
-
     /**
      * The loan repayment just posted above assumed the money came out of whichever account is
-     * this loan product's actual Fund Source -- it didn't really. This puts that fund straight
+     * this loan product's actual Fund Source (not always literally "Cash at Main Vault" -- e.g. a
-     * back, sourced from the Dividend Payable liability instead, so the net effect is exactly
+     * Loan-Against-Warehouse-Receipt product debits its own "Warehouse Receipt" account instead)
-     * "liability shrinks, loan reduces, that fund-source account is unaffected". Skipped (loan
+     * -- it didn't really. Rather than reverse that with a second manual entry pair (which would
-     * still updated) if the bank hasn't mapped the Dividend Payable financial activity, or if the
+     * leave that fund-source account appearing twice, once debited then immediately credited back
-     * repayment's own debit leg couldn't be found.
+     * -- a confusing "wash" no real accountant would post), this rewrites that same DEBIT leg's
+     * account in place to Dividend Payable, so the transaction ends up with exactly the entries a
+     * real accountant would expect: Dividend Payable debited, Loan Portfolio/Income credited,
+     * nothing else touched. Skipped (loan still updated) if the bank hasn't mapped the Dividend
+     * Payable financial activity.
      */
-    private void replenishFundSourceFromDividendPayable(final Long lockId, final String currencyCode, final BigDecimal amount,
+    private void redirectFundSourceDebitToDividendPayable(final Long loanTransactionId) {
-            final LocalDate entryDate, final Long fundSourceAccountId) {
         final Long payableDividendsAccountId = jdbcTemplate
                 .queryForList("SELECT gl_account_id FROM acc_gl_financial_activity_account WHERE financial_activity_type = ?", Long.class,
                         FINANCIAL_ACTIVITY_PAYABLE_DIVIDENDS)
                 .stream().findFirst().orElse(null);
-        if (payableDividendsAccountId == null || fundSourceAccountId == null) {
+        if (payableDividendsAccountId == null) {
             return;
         }
-
+        jdbcTemplate.update("UPDATE acc_gl_journal_entry SET account_id = ? WHERE loan_transaction_id = ? AND type_enum = ?",
-        final AppUser currentUser = context.authenticatedUser();
+                payableDividendsAccountId, loanTransactionId, JOURNAL_ENTRY_TYPE_DEBIT);
-        final java.sql.Date sqlEntryDate = java.sql.Date.valueOf(entryDate);
-        final String transactionId = "DIVAPPLYLOAN" + lockId + "-" + System.nanoTime();
-        final String description = "Unclaimed dividend lock #" + lockId + " applied to loan";
-        final String insertSql = """
-                INSERT INTO acc_gl_journal_entry
-                    (account_id, office_id, currency_code, transaction_id, reversed, manual_entry, entry_date, type_enum, amount,
-                     description, created_by, last_modified_by, created_date, lastmodified_date, created_on_utc, last_modified_on_utc,
-                     submitted_on_date, transaction_date)
-                VALUES (?, 1, ?, ?, false, true, ?, ?, ?, ?, ?, ?, now(), now(), now(), now(), ?, ?)
-                """;
-        this.jdbcTemplate.update(insertSql, payableDividendsAccountId, currencyCode, transactionId, sqlEntryDate, 2, amount, description,
-                currentUser.getId(), currentUser.getId(), sqlEntryDate, sqlEntryDate);
-        this.jdbcTemplate.update(insertSql, fundSourceAccountId, currencyCode, transactionId, sqlEntryDate, 1, amount, description,
-                currentUser.getId(), currentUser.getId(), sqlEntryDate, sqlEntryDate);
     }
 
     private WebApplicationException apiError(final int httpStatus, final String message) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/loanoriginationpipeline/api/LoanOriginationPipelineApiResource.java

@@ -0,0 +1,277 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.loanoriginationpipeline.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationPipelineService;
+import org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationStageService;
+import org.springframework.stereotype.Component;
+
+/**
+ * REST endpoints for the Loan Origination Pipeline — the sanctioning workflow an application walks
+ * through before a real loan account is ever opened (Application → KYC/OVD → CIC Credit Bureau Check
+ * → Field Investigation → Personal Discussion → Credit Committee → Risk Approval → Legal Approval →
+ * Customer Signing → Cheque/ACH → Post-Disbursement Check → Disbursed).
+ *
+ * <pre>
+ *   GET  /v1/loan-origination/applications                    – list (optional branchCode/stage/status filters)
+ *   GET  /v1/loan-origination/applications/{applicationNo}    – one application, in full
+ *   POST /v1/loan-origination/applications                    – create from the New Application wizard
+ *   PUT  /v1/loan-origination/applications/{applicationNo}    – save the whole application back
+ *   POST /v1/loan-origination/applications/seed               – one-time seed; no-ops if already seeded
+ * </pre>
+ *
+ * <p>
+ * Requests/responses are the application object verbatim, so the request body is passed straight
+ * through as JSON rather than being bound to a DTO. A DTO would have to mirror all ~111 workflow
+ * fields and would silently drop any field it had not been updated to know about — the exact failure
+ * this module has to avoid, since the workflow gains fields regularly.
+ *
+ * <p>
+ * Authorisation is a normal authenticated staff session. These endpoints deliberately do not define
+ * their own permission codes: the pipeline is the sanctioning process for lending, so it is gated by
+ * the same authenticated-staff check the rest of the loan screens use, and per-stage authority
+ * (who may sit on the Credit Committee, who signs off Risk/Legal) is a workflow concern enforced on
+ * the application record itself, not a Fineract entity permission.
+ */
+@Path("/v1/loan-origination/applications")
+@Component
+@Tag(name = "Loan Origination Pipeline",
+        description = "Pre-disbursement sanctioning workflow: KYC/OVD, CIC credit bureau check, Field Investigation, "
+                + "Personal Discussion, Credit Committee, Risk & Legal approval, signing and disbursement.")
+@RequiredArgsConstructor
+public class LoanOriginationPipelineApiResource {
+
+    private final PlatformSecurityContext context;
+    private final LoanOriginationPipelineService service;
+    private final LoanOriginationStageService stageService;
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "List loan origination applications",
+            description = "Newest first. Filters are optional — the Pipeline screen also filters client-side.")
+    public String retrieveAll(@QueryParam("branchCode") final String branchCode, @QueryParam("stage") final String stage,
+            @QueryParam("status") final String status) {
+        this.context.authenticatedUser();
+        return this.service.findAllAsJson(branchCode, stage, status);
+    }
+
+    @GET
+    @Path("{applicationNo}")
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Retrieve one loan origination application in full")
+    public String retrieveOne(@PathParam("applicationNo") final String applicationNo) {
+        this.context.authenticatedUser();
+        return this.service.findOneAsJson(applicationNo);
+    }
+
+    @POST
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Create a loan origination application",
+            description = "Body is the application object as built by the New Application wizard.")
+    public String create(final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.service.create(apiRequestBodyAsJson);
+    }
+
+    @PUT
+    @Path("{applicationNo}")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Save a loan origination application",
+            description = "Full-object save: the body replaces the stored application, its stage history, "
+                    + "approvals, field-investigation checks and document checklists.")
+    public String save(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.service.save(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("seed")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Seed the pipeline once",
+            description = "Inserts the supplied applications only when the pipeline is empty, so reloading the "
+                    + "frontend cannot duplicate the book. Returns the number actually inserted.")
+    public String seed(final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return "{\"seeded\":" + this.service.seed(apiRequestBodyAsJson) + "}";
+    }
+
+    // ─────────────────────────────────────────────────────────────────────────
+    // Per-stage transitions.
+    //
+    // Each of these takes only its own step's inputs (who acted, remarks, a resolution number) and
+    // lets the server validate the stage's prerequisites against the stored record before applying
+    // the change. The full-object PUT above still exists for inline field edits; these exist because
+    // a sanctioning decision should not be something a caller can simply assert. Every one returns
+    // the updated application, so the client replaces its copy rather than guessing the result.
+    // ─────────────────────────────────────────────────────────────────────────
+
+    @POST
+    @Path("{applicationNo}/kyc-complete")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Complete KYC & Document Collection",
+            description = "Requires Aadhaar/PAN verified, income proof, bank statement and address proof submitted, "
+                    + "income assessed, and every product-specific document submitted.")
+    public String completeKyc(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.completeKyc(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/cic-complete")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Complete the CIC / credit bureau check",
+            description = "Requires the borrower's signed consent, the collected bureau charge and an uploaded report.")
+    public String completeCicCheck(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.completeCicCheck(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/field-investigation/{checkKey}/verify")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Mark one field investigation check verified",
+            description = "Requires an assigned officer, GPS coordinates and at least one site photograph "
+                    + "to already be recorded against the visit.")
+    public String verifyFieldCheck(@PathParam("applicationNo") final String applicationNo,
+            @PathParam("checkKey") final String checkKey, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.verifyFieldCheck(applicationNo, checkKey, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/field-investigation/{checkKey}/reject")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Mark one field investigation check failed", description = "A reason is mandatory.")
+    public String rejectFieldCheck(@PathParam("applicationNo") final String applicationNo,
+            @PathParam("checkKey") final String checkKey, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.rejectFieldCheck(applicationNo, checkKey, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/field-investigation/complete")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Complete Field Investigation",
+            description = "Requires every applicable check (address, office, plus property when secured and shop "
+                    + "when the applicant runs one) to be verified.")
+    public String completeFieldInvestigation(@PathParam("applicationNo") final String applicationNo,
+            final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.completeFieldInvestigation(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/personal-discussion/clear")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Clear the personal discussion and proceed")
+    public String clearPersonalDiscussion(@PathParam("applicationNo") final String applicationNo,
+            final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.clearPersonalDiscussion(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/personal-discussion/flag")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Flag a discrepancy and hold the application",
+            description = "A discrepancy type and notes are both mandatory.")
+    public String flagDiscrepancy(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.flagDiscrepancy(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/personal-discussion/resolve")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Resolve a held discrepancy and proceed")
+    public String resolveDiscrepancy(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.resolveDiscrepancy(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/approvals/{field}")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Record an approval decision",
+            description = "`field` is one of creditCommitteeApproval, riskApproval, legalApproval, postCheckApproval. "
+                    + "An APPROVED decision is checked against that stage's own checklist — the Credit Committee also "
+                    + "requires a resolution number and date. A REJECTED decision is always permitted.")
+    public String decideApproval(@PathParam("applicationNo") final String applicationNo, @PathParam("field") final String field,
+            final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.decideApproval(applicationNo, field, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/signing")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Record the customer's signing of the loan agreement")
+    public String markSigned(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.markSigned(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/cheque-ach")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Confirm security cheques received and ACH mandate signed")
+    public String confirmChequeAch(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.confirmChequeAch(applicationNo, apiRequestBodyAsJson);
+    }
+
+    @POST
+    @Path("{applicationNo}/disburse")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    @Operation(summary = "Disburse the loan",
+            description = "Requires all four approval levels to stand as approved and the customer to have signed. "
+                    + "Optionally records the real Fineract loan account created at disbursement.")
+    public String disburse(@PathParam("applicationNo") final String applicationNo, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser();
+        return this.stageService.disburse(applicationNo, apiRequestBodyAsJson);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/loanoriginationpipeline/service/LoanOriginationJson.java

@@ -0,0 +1,138 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.loanoriginationpipeline.service;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import java.math.BigDecimal;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+
+/**
+ * Null-safe accessors for the loan origination application object.
+ *
+ * <p>
+ * The application is handled as JSON rather than a typed entity (see
+ * {@link LoanOriginationPipelineService} for why), so every read has to tolerate a key being absent,
+ * explicitly null, or the wrong JSON type — an older application stored before a field existed is a
+ * normal, expected case, not an error. These helpers turn all three into a sensible default so no
+ * caller has to repeat the checks.
+ */
+public final class LoanOriginationJson {
+
+    private LoanOriginationJson() {}
+
+    public static JsonObject parseObject(final String body) {
+        if (body == null || body.isBlank()) {
+            // An action with no inputs (e.g. "mark signed") legitimately posts an empty body.
+            return new JsonObject();
+        }
+        final JsonElement parsed = JsonParser.parseString(body);
+        if (!parsed.isJsonObject()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.body.invalid",
+                    "Request body must be a JSON object.");
+        }
+        return parsed.getAsJsonObject();
+    }
+
+    public static boolean present(final JsonObject obj, final String key) {
+        return obj != null && obj.has(key) && !obj.get(key).isJsonNull();
+    }
+
+    public static String str(final JsonObject obj, final String key) {
+        return present(obj, key) && obj.get(key).isJsonPrimitive() ? obj.get(key).getAsString() : null;
+    }
+
+    /** Trimmed value, or the fallback when absent/blank. */
+    public static String strOr(final JsonObject obj, final String key, final String fallback) {
+        final String value = str(obj, key);
+        return value == null || value.isBlank() ? fallback : value.trim();
+    }
+
+    /**
+     * True when a field holds real content. Treats the {@code '—'} em-dash as empty: the workflow uses
+     * it as a "nothing recorded yet" placeholder throughout, so a check for "has this been filled in"
+     * has to reject it or every blank field would read as populated.
+     */
+    public static boolean filled(final JsonObject obj, final String key) {
+        final String value = str(obj, key);
+        return value != null && !value.trim().isEmpty() && !"—".equals(value.trim());
+    }
+
+    public static Long lng(final JsonObject obj, final String key) {
+        try {
+            return present(obj, key) && obj.get(key).isJsonPrimitive() ? obj.get(key).getAsLong() : null;
+        } catch (final NumberFormatException e) {
+            return null;
+        }
+    }
+
+    public static BigDecimal dec(final JsonObject obj, final String key) {
+        try {
+            return present(obj, key) && obj.get(key).isJsonPrimitive() ? obj.get(key).getAsBigDecimal() : null;
+        } catch (final NumberFormatException e) {
+            return null;
+        }
+    }
+
+    public static boolean bool(final JsonObject obj, final String key) {
+        return present(obj, key) && obj.get(key).isJsonPrimitive() && obj.get(key).getAsBoolean();
+    }
+
+    public static int intOr(final JsonObject obj, final String key, final int fallback) {
+        try {
+            return present(obj, key) && obj.get(key).isJsonPrimitive() ? obj.get(key).getAsInt() : fallback;
+        } catch (final NumberFormatException e) {
+            return fallback;
+        }
+    }
+
+    public static JsonObject obj(final JsonObject parent, final String key) {
+        return present(parent, key) && parent.get(key).isJsonObject() ? parent.getAsJsonObject(key) : null;
+    }
+
+    /** The nested object, creating and attaching an empty one if it isn't there yet. */
+    public static JsonObject objOrCreate(final JsonObject parent, final String key) {
+        final JsonObject existing = obj(parent, key);
+        if (existing != null) {
+            return existing;
+        }
+        final JsonObject created = new JsonObject();
+        parent.add(key, created);
+        return created;
+    }
+
+    public static JsonArray arr(final JsonObject parent, final String key) {
+        return present(parent, key) && parent.get(key).isJsonArray() ? parent.getAsJsonArray(key) : new JsonArray();
+    }
+
+    public static JsonArray arrOrCreate(final JsonObject parent, final String key) {
+        if (present(parent, key) && parent.get(key).isJsonArray()) {
+            return parent.getAsJsonArray(key);
+        }
+        final JsonArray created = new JsonArray();
+        parent.add(key, created);
+        return created;
+    }
+
+    public static String rawJson(final JsonObject obj, final String key) {
+        return present(obj, key) ? obj.get(key).toString() : null;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/loanoriginationpipeline/service/LoanOriginationPipelineService.java

@@ -0,0 +1,403 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.loanoriginationpipeline.service;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Persistence for the Loan Origination Pipeline — the pre-disbursement sanctioning workflow
+ * (Application → KYC → CIC Check → Field Investigation → Personal Discussion → Credit Committee →
+ * Risk → Legal → Signing → Cheque/ACH → Post-Check → Disbursed).
+ *
+ * <p>
+ * <b>Storage shape.</b> {@code payload} holds the complete application object as JSON and is the
+ * single source of truth for reads. The dozen real columns on
+ * {@code m_loan_origination_application}, and the four child tables, are <i>derived indexes</i> —
+ * they exist so the Pipeline list, the Channel/BC/Share reports, Target-vs-Actual and audit queries
+ * ("every application this officer approved") can be plain SQL instead of scanning JSON. They are
+ * never read back into the application object.
+ *
+ * <p>
+ * That deliberately stores those fields twice, which is the right trade here: every write goes
+ * through {@link #writeApplication} in one transaction and rewrites the payload, the columns and all
+ * child rows together from the same source, so the copies cannot drift. The alternative — splitting
+ * fields so nothing repeats — would force the read path to reconstruct a dozen values back out of
+ * SQL types (a {@code DECIMAL(19,6)} returning {@code 100000.000000} where the UI expects
+ * {@code 100000}, a null {@code BIGINT} vs an absent key), which is exactly the class of silent
+ * field-level corruption this module cannot afford.
+ *
+ * <p>
+ * The one field kept out of {@code payload} is {@code cicParsedAnalysis} — a parsed credit-bureau
+ * report with a per-account seven-year day-past-due grid. It is large, opaque and only ever rendered
+ * whole, so it gets its own column rather than being duplicated alongside everything else.
+ *
+ * <p>
+ * Because the payload is "the whole object minus that one field" rather than an allowlist of known
+ * keys, a field added to the workflow later persists with no schema or code change here. Given how
+ * fast this workflow gains fields, an allowlist would drop them silently.
+ */
+@Service
+@RequiredArgsConstructor
+public class LoanOriginationPipelineService {
+
+    /** Pulled out of the payload into its own column — see class javadoc. */
+    private static final String CIC_ANALYSIS_KEY = "cicParsedAnalysis";
+
+    /**
+     * The row's primary key. Kept out of the payload so it can only ever come from the column — a
+     * stale id round-tripped inside the JSON would silently point uploaded documents at the wrong
+     * application.
+     */
+    private static final String ID_KEY = "id";
+
+    private static final String SELECT_COLUMNS = "id, payload, cic_parsed_analysis";
+
+    private final JdbcTemplate jdbcTemplate;
+
+    // ── Read ─────────────────────────────────────────────────────────────────
+
+    /**
+     * Every application, newest first. Optional filters are pushed into SQL; the Pipeline screen also
+     * filters in-memory, so passing nothing here is perfectly valid.
+     */
+    public String findAllAsJson(final String branchCode, final String stage, final String status) {
+        final StringBuilder sql = new StringBuilder("SELECT " + SELECT_COLUMNS + " FROM m_loan_origination_application WHERE 1=1");
+        final List<Object> params = new ArrayList<>();
+        if (isSet(branchCode)) {
+            sql.append(" AND branch_code = ?");
+            params.add(branchCode);
+        }
+        if (isSet(stage)) {
+            sql.append(" AND current_stage = ?");
+            params.add(stage);
+        }
+        if (isSet(status)) {
+            sql.append(" AND overall_status = ?");
+            params.add(status);
+        }
+        sql.append(" ORDER BY id DESC");
+
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList(sql.toString(), params.toArray());
+        final JsonArray out = new JsonArray();
+        for (final Map<String, Object> row : rows) {
+            out.add(reassemble(row));
+        }
+        return out.toString();
+    }
+
+    public String findOneAsJson(final String applicationNo) {
+        return loadApplication(applicationNo).toString();
+    }
+
+    /**
+     * Loads one application as a mutable object. This is the entry point the per-stage endpoints use:
+     * they validate and apply their transition against the state that is actually stored, never
+     * against what a caller claims it is.
+     */
+    public JsonObject loadApplication(final String applicationNo) {
+        final List<Map<String, Object>> rows = jdbcTemplate
+                .queryForList("SELECT " + SELECT_COLUMNS + " FROM m_loan_origination_application WHERE application_no = ?",
+                        applicationNo);
+        if (rows.isEmpty()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.application.not.found",
+                    "No loan origination application found with number " + applicationNo + ".", applicationNo);
+        }
+        return reassemble(rows.get(0));
+    }
+
+    /**
+     * Rebuilds the application object: the stored payload, with the bureau report re-attached and the
+     * row's own id surfaced. The id is what uploaded files hang off — documents are stored against
+     * {@code m_document.parent_entity_id}, so the client needs it to upload and fetch attachments.
+     */
+    private JsonObject reassemble(final Map<String, Object> row) {
+        final JsonObject app = parseObject(asString(row.get("payload")));
+        final Object id = row.get("id");
+        if (id != null) {
+            app.addProperty("id", Long.valueOf(id.toString()));
+        }
+        final String cic = asString(row.get("cic_parsed_analysis"));
+        if (cic != null && !cic.isBlank()) {
+            app.add(CIC_ANALYSIS_KEY, JsonParser.parseString(cic));
+        }
+        return app;
+    }
+
+    // ── Write ────────────────────────────────────────────────────────────────
+
+    /**
+     * Creates an application. The caller (the New Application wizard) has already derived the
+     * application number and the blank per-stage structures, so this stores the object as given
+     * rather than re-deriving a second, competing set of defaults server-side.
+     */
+    @Transactional
+    public String create(final String requestBodyAsJson) {
+        final JsonObject app = parseObject(requestBodyAsJson);
+        final String applicationNo = stringOrNull(app, "applicationNo");
+        if (applicationNo == null || applicationNo.isBlank()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.application.no.required",
+                    "applicationNo is required.");
+        }
+        final Long existing = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_loan_origination_application WHERE application_no = ?", Long.class, applicationNo);
+        if (existing != null && existing > 0) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.application.duplicate",
+                    "An application numbered " + applicationNo + " already exists.", applicationNo);
+        }
+        // Read back rather than echoing the request: the caller needs the assigned id to be able to
+        // attach documents to this application.
+        insertApplication(app);
+        return findOneAsJson(applicationNo);
+    }
+
+    /**
+     * Full-object save. The workflow's stage transitions are all applied client-side against the
+     * whole application object, so the whole object is what gets written back — there is no
+     * per-action field allowlist that could quietly omit a field.
+     */
+    @Transactional
+    public String save(final String applicationNo, final String requestBodyAsJson) {
+        return storeApplication(applicationNo, parseObject(requestBodyAsJson));
+    }
+
+    /** Writes a whole application object back. Shared by the full-object save and every per-stage
+     *  endpoint, so both paths persist through exactly the same code. */
+    @Transactional
+    public String storeApplication(final String applicationNo, final JsonObject app) {
+        final Long id = findIdOrThrow(applicationNo);
+
+        final JsonObject payload = app.deepCopy();
+        payload.remove(CIC_ANALYSIS_KEY);
+        payload.remove(ID_KEY);
+
+        jdbcTemplate.update("""
+                UPDATE m_loan_origination_application SET
+                    applicant_name = ?, client_id = ?, branch_code = ?, channel = ?, bc_agent_name = ?,
+                    product_code = ?, requested_amount = ?, current_stage = ?, overall_status = ?,
+                    is_share_member = ?, fineract_loan_id = ?, payload = ?, cic_parsed_analysis = ?,
+                    last_modified_date = CURRENT_TIMESTAMP
+                WHERE id = ?
+                """, stringOrNull(app, "applicantName"), longOrNull(app, "clientId"), stringOrNull(app, "branchCode"),
+                stringOrNull(app, "channel"), stringOrNull(app, "bcAgentName"), stringOrNull(app, "productCode"),
+                decimalOrNull(app, "requestedAmount"), stringOrNull(app, "currentStage"), stringOrNull(app, "overallStatus"),
+                boolOrFalse(app, "isShareMember"), longOrNull(app, "fineractLoanId"), payload.toString(),
+                childJsonOrNull(app, CIC_ANALYSIS_KEY), id);
+
+        writeChildren(id, app);
+        return findOneAsJson(applicationNo);
+    }
+
+    /**
+     * One-time seed. Idempotent by design: it is called on first page load and must not duplicate the
+     * book if the frontend is reloaded, so a non-empty table short-circuits to 0.
+     */
+    @Transactional
+    public int seed(final String requestBodyAsJson) {
+        final Long existing = jdbcTemplate.queryForObject("SELECT COUNT(*) FROM m_loan_origination_application", Long.class);
+        if (existing != null && existing > 0) {
+            return 0;
+        }
+        final JsonElement parsed = JsonParser.parseString(requestBodyAsJson == null ? "[]" : requestBodyAsJson);
+        if (!parsed.isJsonArray()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.seed.invalid",
+                    "Seed body must be a JSON array of applications.");
+        }
+        int seeded = 0;
+        for (final JsonElement element : parsed.getAsJsonArray()) {
+            if (element.isJsonObject()) {
+                insertApplication(element.getAsJsonObject());
+                seeded++;
+            }
+        }
+        return seeded;
+    }
+
+    private void insertApplication(final JsonObject app) {
+        final JsonObject payload = app.deepCopy();
+        payload.remove(CIC_ANALYSIS_KEY);
+        payload.remove(ID_KEY);
+
+        jdbcTemplate.update("""
+                INSERT INTO m_loan_origination_application
+                    (application_no, applicant_name, client_id, branch_code, channel, bc_agent_name,
+                     product_code, requested_amount, current_stage, overall_status, is_share_member,
+                     fineract_loan_id, payload, cic_parsed_analysis)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """, stringOrNull(app, "applicationNo"), stringOrNull(app, "applicantName"), longOrNull(app, "clientId"),
+                stringOrNull(app, "branchCode"), stringOrNull(app, "channel"), stringOrNull(app, "bcAgentName"),
+                stringOrNull(app, "productCode"), decimalOrNull(app, "requestedAmount"), stringOrNull(app, "currentStage"),
+                stringOrNull(app, "overallStatus"), boolOrFalse(app, "isShareMember"), longOrNull(app, "fineractLoanId"),
+                payload.toString(), childJsonOrNull(app, CIC_ANALYSIS_KEY));
+
+        final Long id = jdbcTemplate.queryForObject("SELECT id FROM m_loan_origination_application WHERE application_no = ?",
+                Long.class, stringOrNull(app, "applicationNo"));
+        writeChildren(id, app);
+    }
+
+    /**
+     * Rewrites the derived child rows for one application. Delete-then-insert rather than a per-row
+     * diff: these collections are small (a stage history is a dozen rows), and a full rewrite cannot
+     * leave a stale row behind the way a partial diff can.
+     */
+    private void writeChildren(final Long id, final JsonObject app) {
+        jdbcTemplate.update("DELETE FROM m_loan_origination_stage_history WHERE application_id = ?", id);
+        jdbcTemplate.update("DELETE FROM m_loan_origination_approval WHERE application_id = ?", id);
+        jdbcTemplate.update("DELETE FROM m_loan_origination_fi_check WHERE application_id = ?", id);
+        jdbcTemplate.update("DELETE FROM m_loan_origination_document WHERE application_id = ?", id);
+
+        final JsonArray history = arrayOrEmpty(app, "stageHistory");
+        for (int i = 0; i < history.size(); i++) {
+            if (!history.get(i).isJsonObject()) {
+                continue;
+            }
+            final JsonObject entry = history.get(i).getAsJsonObject();
+            jdbcTemplate.update("""
+                    INSERT INTO m_loan_origination_stage_history
+                        (application_id, seq_no, stage, action_date, action_by, outcome, remarks)
+                    VALUES (?, ?, ?, ?, ?, ?, ?)
+                    """, id, i, stringOrNull(entry, "stage"), stringOrNull(entry, "date"), stringOrNull(entry, "actionBy"),
+                    stringOrNull(entry, "outcome"), stringOrNull(entry, "remarks"));
+        }
+
+        for (final String field : new String[] { "creditCommitteeApproval", "riskApproval", "legalApproval", "postCheckApproval" }) {
+            final JsonObject approval = objectOrNull(app, field);
+            if (approval == null) {
+                continue;
+            }
+            jdbcTemplate.update("""
+                    INSERT INTO m_loan_origination_approval
+                        (application_id, approval_field, decision, approver_name, approver_role, decision_date, remarks)
+                    VALUES (?, ?, ?, ?, ?, ?, ?)
+                    """, id, field, stringOrNull(approval, "decision"), stringOrNull(approval, "approverName"),
+                    stringOrNull(approval, "approverRole"), stringOrNull(approval, "date"), stringOrNull(approval, "remarks"));
+        }
+
+        for (final String key : new String[] { "addressVerification", "officeVerification", "propertyVerification",
+                "shopVerification" }) {
+            final JsonObject check = objectOrNull(app, key);
+            if (check == null) {
+                continue;
+            }
+            jdbcTemplate.update("""
+                    INSERT INTO m_loan_origination_fi_check
+                        (application_id, check_key, status, verified_by, verified_date, remarks, officer_assigned,
+                         assigned_date, assigned_at, latitude, longitude, photo_count)
+                    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                    """, id, key, stringOrNull(check, "status"), stringOrNull(check, "verifiedBy"),
+                    stringOrNull(check, "verifiedDate"), stringOrNull(check, "remarks"), stringOrNull(check, "officerAssigned"),
+                    stringOrNull(check, "assignedDate"), longOrNull(check, "assignedAt"), stringOrNull(check, "latitude"),
+                    stringOrNull(check, "longitude"), intOrZero(check, "photoCount"));
+        }
+
+        insertDocuments(id, arrayOrEmpty(app, "productDocuments"), "PRODUCT");
+        insertDocuments(id, arrayOrEmpty(app, "legalDocuments"), "LEGAL");
+    }
+
+    private void insertDocuments(final Long id, final JsonArray docs, final String kind) {
+        for (int i = 0; i < docs.size(); i++) {
+            if (!docs.get(i).isJsonObject()) {
+                continue;
+            }
+            final JsonObject doc = docs.get(i).getAsJsonObject();
+            jdbcTemplate.update("""
+                    INSERT INTO m_loan_origination_document
+                        (application_id, doc_kind, doc_key, label, hint, is_custom, submitted, seq_no)
+                    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+                    """, id, kind, stringOrNull(doc, "key"), stringOrNull(doc, "label"), stringOrNull(doc, "hint"),
+                    boolOrFalse(doc, "custom"), boolOrFalse(doc, "submitted"), i);
+        }
+    }
+
+    private Long findIdOrThrow(final String applicationNo) {
+        final List<Long> ids = jdbcTemplate.queryForList("SELECT id FROM m_loan_origination_application WHERE application_no = ?",
+                Long.class, applicationNo);
+        if (ids.isEmpty()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.application.not.found",
+                    "No loan origination application found with number " + applicationNo + ".", applicationNo);
+        }
+        return ids.get(0);
+    }
+
+    // ── JSON helpers ─────────────────────────────────────────────────────────
+    // Thin aliases over LoanOriginationJson so this class and the per-stage service share one
+    // implementation of the null/absent/wrong-type handling rather than each keeping its own.
+
+    private JsonObject parseObject(final String body) {
+        if (body == null || body.isBlank()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.loan.origination.body.required", "A request body is required.");
+        }
+        return LoanOriginationJson.parseObject(body);
+    }
+
+    private boolean present(final JsonObject obj, final String key) {
+        return LoanOriginationJson.present(obj, key);
+    }
+
+    private String stringOrNull(final JsonObject obj, final String key) {
+        return LoanOriginationJson.str(obj, key);
+    }
+
+    private Long longOrNull(final JsonObject obj, final String key) {
+        return LoanOriginationJson.lng(obj, key);
+    }
+
+    private BigDecimal decimalOrNull(final JsonObject obj, final String key) {
+        return LoanOriginationJson.dec(obj, key);
+    }
+
+    private boolean boolOrFalse(final JsonObject obj, final String key) {
+        return LoanOriginationJson.bool(obj, key);
+    }
+
+    private int intOrZero(final JsonObject obj, final String key) {
+        return LoanOriginationJson.intOr(obj, key, 0);
+    }
+
+    private JsonObject objectOrNull(final JsonObject obj, final String key) {
+        return LoanOriginationJson.obj(obj, key);
+    }
+
+    private JsonArray arrayOrEmpty(final JsonObject obj, final String key) {
+        return LoanOriginationJson.arr(obj, key);
+    }
+
+    private String childJsonOrNull(final JsonObject obj, final String key) {
+        return LoanOriginationJson.rawJson(obj, key);
+    }
+
+    private String asString(final Object value) {
+        return value == null ? null : value.toString();
+    }
+
+    private boolean isSet(final String value) {
+        return value != null && !value.isBlank();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/loanoriginationpipeline/service/LoanOriginationStageService.java

@@ -0,0 +1,517 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.loanoriginationpipeline.service;
+
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.arr;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.arrOrCreate;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.bool;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.filled;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.intOr;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.obj;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.objOrCreate;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.parseObject;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.str;
+import static org.apache.fineract.portfolio.loanoriginationpipeline.service.LoanOriginationJson.strOr;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import java.util.Arrays;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Server-side stage transitions for the Loan Origination Pipeline.
+ *
+ * <p>
+ * Each method here owns one sanctioning step: it loads the application <b>as stored</b>, checks that
+ * step's preconditions against that stored state, applies the change, appends the audit-trail entry
+ * and saves. The caller supplies only that step's own inputs (who acted, remarks, a resolution
+ * number) — never the resulting state — so a client cannot approve a stage whose prerequisites are
+ * not actually met, mark a field visit verified without the GPS fix and photographs really being on
+ * file, or minute a Credit Committee decision without a resolution number.
+ *
+ * <p>
+ * That distinction matters for a sanctioning workflow: the screen also disables those buttons, but UI
+ * gating is a convenience, not a control — it is bypassed by any direct call to the API. These checks
+ * are the control. They are deliberately the same rules the screen enforces, so an officer never sees
+ * an enabled button that the server then rejects.
+ *
+ * <p>
+ * Dates are written in the {@code dd-MM-yyyy} form the rest of the workflow record already uses, and
+ * "nothing recorded" stays the {@code '—'} placeholder the existing data uses, so a server-applied
+ * transition is indistinguishable in shape from the client-applied ones already stored.
+ */
+@Service
+@RequiredArgsConstructor
+public class LoanOriginationStageService {
+
+    private static final DateTimeFormatter WORKFLOW_DATE = DateTimeFormatter.ofPattern("dd-MM-yyyy");
+
+    /** Must stay in step with STAGE_ORDER on the Application Detail screen. */
+    private static final List<String> STAGE_ORDER = List.of("APPLICATION", "KYC_DOCUMENTS", "CIC_CHECK", "FIELD_INVESTIGATION",
+            "PERSONAL_DISCUSSION", "CREDIT_COMMITTEE", "RISK_APPROVAL", "LEGAL_APPROVAL", "CUSTOMER_SIGNING", "CHEQUE_ACH",
+            "POST_CHECK", "DISBURSED");
+
+    private static final List<String> FI_CHECK_KEYS = List.of("addressVerification", "officeVerification", "propertyVerification",
+            "shopVerification");
+
+    private final LoanOriginationPipelineService pipelineService;
+
+    // ── KYC & Documents ──────────────────────────────────────────────────────
+
+    @Transactional
+    public String completeKyc(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "KYC_DOCUMENTS");
+
+        require(bool(app, "aadhaarVerified"), "Aadhaar has not been verified.");
+        require(bool(app, "panVerified"), "PAN has not been verified.");
+        require(bool(app, "incomeProofSubmitted"), "Income proof has not been submitted.");
+        require(bool(app, "bankStatementSubmitted"), "Bank statement has not been submitted.");
+        require(bool(app, "electricityBillSubmitted"), "Address proof (electricity bill) has not been submitted.");
+        require(intOr(app, "monthlyIncome", 0) > 0, "Monthly income has not been assessed.");
+        for (final JsonElement element : arr(app, "productDocuments")) {
+            final JsonObject doc = element.getAsJsonObject();
+            require(bool(doc, "submitted"), "Required document not submitted: " + strOr(doc, "label", strOr(doc, "key", "document")));
+        }
+
+        advance(app, actor(input), "KYC Complete", strOr(input, "remarks", "KYC and document collection complete."));
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    // ── CIC / Credit Bureau ──────────────────────────────────────────────────
+
+    @Transactional
+    public String completeCicCheck(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "CIC_CHECK");
+
+        // RBI's Fair Practices Code requires the borrower's written consent before a bureau pull, and
+        // the bureau's per-pull fee has to have actually been collected.
+        require(bool(app, "cicConsentSigned"), "The borrower's signed credit-bureau consent is not on file.");
+        require(bool(app, "cicChargeCollected"), "The credit bureau check charge has not been collected.");
+        require(bool(app, "cicReportUploaded"), "No credit bureau report has been uploaded.");
+
+        advance(app, actor(input), "CIC Check Complete",
+                strOr(input, "remarks", "Credit bureau report obtained and reviewed. Score " + intOr(app, "cibilScore", 0) + "."));
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    // ── Field Investigation ──────────────────────────────────────────────────
+
+    /**
+     * Marks one field-investigation check verified. The GPS fix and site photographs are checked
+     * against what is stored, which is the point: "I visited" with nothing recorded is exactly what a
+     * field-investigation control exists to prevent.
+     */
+    @Transactional
+    public String verifyFieldCheck(final String applicationNo, final String checkKey, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "FIELD_INVESTIGATION");
+        require(FI_CHECK_KEYS.contains(checkKey), "Unknown field investigation check: " + checkKey);
+
+        final JsonObject check = objOrCreate(app, checkKey);
+        require(filled(check, "officerAssigned"), "No field officer has been assigned to this visit.");
+        require(filled(check, "latitude") && filled(check, "longitude"), "The visit has no GPS coordinates recorded.");
+        require(intOr(check, "photoCount", 0) > 0, "No site photograph has been captured for this visit.");
+
+        check.addProperty("status", "VERIFIED");
+        check.addProperty("verifiedBy", strOr(input, "verifiedBy", strOr(check, "officerAssigned", "Field Officer")));
+        check.addProperty("verifiedDate", today());
+        check.addProperty("remarks", strOr(input, "remarks", "Visited and confirmed correct."));
+
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    @Transactional
+    public String rejectFieldCheck(final String applicationNo, final String checkKey, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "FIELD_INVESTIGATION");
+        require(FI_CHECK_KEYS.contains(checkKey), "Unknown field investigation check: " + checkKey);
+        // A failed visit must say why -- it is what the Personal Discussion stage then works from.
+        final String remarks = strOr(input, "remarks", "");
+        require(!remarks.isBlank(), "A reason is required when a field visit fails.");
+
+        final JsonObject check = objOrCreate(app, checkKey);
+        check.addProperty("status", "FAILED");
+        check.addProperty("verifiedBy", strOr(input, "verifiedBy", strOr(check, "officerAssigned", "Field Officer")));
+        check.addProperty("verifiedDate", today());
+        check.addProperty("remarks", remarks);
+
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    @Transactional
+    public String completeFieldInvestigation(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "FIELD_INVESTIGATION");
+        requireFieldInvestigationComplete(app);
+
+        advance(app, actor(input), "FI Complete", strOr(input, "remarks", "Field investigation complete on all applicable checks."));
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    // ── Personal Discussion ──────────────────────────────────────────────────
+
+    @Transactional
+    public String clearPersonalDiscussion(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "PERSONAL_DISCUSSION");
+        require(bool(app, "meetingScheduled"), "The personal discussion meeting has not been scheduled.");
+
+        final String remarks = strOr(input, "remarks", "No discrepancy found — cleared to proceed to Loan Committee.");
+        app.addProperty("discrepancyType", "NONE");
+        app.addProperty("overallStatus", "IN_PROGRESS");
+        app.addProperty("personalDiscussionDate", today());
+        app.addProperty("personalDiscussionNotes", remarks);
+        app.addProperty("declarationTaken", true);
+        app.addProperty("declarationDate", today());
+
+        advance(app, actor(input), "Cleared", remarks);
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    @Transactional
+    public String flagDiscrepancy(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "PERSONAL_DISCUSSION");
+
+        final String type = strOr(input, "discrepancyType", "");
+        require(!type.isBlank() && !"NONE".equals(type), "A discrepancy type is required.");
+        final String notes = strOr(input, "remarks", "");
+        require(!notes.isBlank(), "Notes are required when flagging a discrepancy.");
+
+        app.addProperty("discrepancyType", type);
+        app.addProperty("personalDiscussionDate", today());
+        app.addProperty("personalDiscussionNotes", notes);
+        // Held rather than rejected: a discrepancy is resolvable, and the application has to stay
+        // visible as outstanding work rather than dropping out of the pipeline.
+        app.addProperty("overallStatus", "ON_HOLD");
+
+        appendHistory(app, str(app, "currentStage"), actor(input), "Discrepancy Flagged", notes);
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    @Transactional
+    public String resolveDiscrepancy(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "PERSONAL_DISCUSSION");
+        require("ON_HOLD".equals(str(app, "overallStatus")), "This application is not on hold.");
+
+        final String remarks = strOr(input, "remarks", "Discrepancy resolved on further review — cleared to proceed.");
+        app.addProperty("discrepancyType", "NONE");
+        app.addProperty("overallStatus", "IN_PROGRESS");
+        app.addProperty("personalDiscussionNotes", remarks);
+        app.addProperty("declarationTaken", true);
+        app.addProperty("declarationDate", today());
+
+        advance(app, actor(input), "Resolved", remarks);
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    // ── Approvals ────────────────────────────────────────────────────────────
+
+    /**
+     * Records a Credit Committee / Risk / Legal / Post-Check decision.
+     *
+     * @param field one of creditCommitteeApproval, riskApproval, legalApproval, postCheckApproval
+     */
+    @Transactional
+    public String decideApproval(final String applicationNo, final String field, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+
+        final String decision = strOr(input, "decision", "APPROVED");
+        require(List.of("APPROVED", "REJECTED", "EXCEPTION_APPROVED").contains(decision), "Unknown decision: " + decision);
+
+        final String expectedStage = switch (field) {
+            case "creditCommitteeApproval" -> "CREDIT_COMMITTEE";
+            case "riskApproval" -> "RISK_APPROVAL";
+            case "legalApproval" -> "LEGAL_APPROVAL";
+            case "postCheckApproval" -> "POST_CHECK";
+            default -> throw badRequest("Unknown approval stage: " + field);
+        };
+        requireStage(app, expectedStage);
+
+        // Prerequisites are only enforced for a positive decision: a rejection has to remain possible
+        // at any point, and blocking it on an incomplete checklist would trap the application.
+        if (!"REJECTED".equals(decision)) {
+            switch (field) {
+                case "creditCommitteeApproval" -> requireCommitteeReportsReady(app, input);
+                case "riskApproval" -> requireRiskChecklistReady(app);
+                case "legalApproval" -> requireLegalChecklistDone(app);
+                case "postCheckApproval" -> requirePostCheckSignatures(app);
+                default -> throw badRequest("Unknown approval stage: " + field);
+            }
+        }
+
+        String remarks = strOr(input, "remarks", "REJECTED".equals(decision) ? "Declined on review." : "Reviewed and approved.");
+        if ("creditCommitteeApproval".equals(field) && !"REJECTED".equals(decision)) {
+            // The resolution number and date are what the sanction letter later quotes, so they are
+            // recorded on the application and restated in the audit trail.
+            final String resolutionNo = strOr(input, "resolutionNo", "");
+            final String resolutionDate = strOr(input, "resolutionDate", "");
+            app.addProperty("committeeResolutionNo", resolutionNo);
+            app.addProperty("committeeResolutionDate", resolutionDate);
+            remarks = remarks + " (Resolution No. " + resolutionNo + " dated " + resolutionDate + ")";
+        }
+
+        final JsonObject approval = objOrCreate(app, field);
+        approval.addProperty("decision", decision);
+        approval.addProperty("approverName", strOr(input, "approverName", "Bank Staff"));
+        approval.addProperty("approverRole", strOr(input, "approverRole", expectedStage));
+        approval.addProperty("date", today());
+        approval.addProperty("remarks", remarks);
+
+        if ("REJECTED".equals(decision)) {
+            app.addProperty("overallStatus", "REJECTED");
+            appendHistory(app, str(app, "currentStage"), actor(input), "Rejected", remarks);
+        } else {
+            advance(app, actor(input), "EXCEPTION_APPROVED".equals(decision) ? "Approved on Exception" : "Approved", remarks);
+        }
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    // ── Signing / Cheque-ACH / Disbursement ──────────────────────────────────
+
+    @Transactional
+    public String markSigned(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "CUSTOMER_SIGNING");
+        require(filled(app, "agreementSigningSlot"), "No agreement signing slot has been recorded.");
+
+        app.addProperty("customerSigningDate", today());
+        advance(app, strOr(input, "actionBy", strOr(app, "applicantName", "Customer")), "Signed",
+                strOr(input, "remarks", "Loan agreement signed by the customer."));
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    @Transactional
+    public String confirmChequeAch(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "CHEQUE_ACH");
+        require(bool(app, "chequeReceived"), "Security cheques have not been received.");
+        require(bool(app, "achSigned"), "The ACH/NACH mandate has not been signed.");
+
+        advance(app, actor(input), "Cheque & ACH Received",
+                strOr(input, "remarks", "Security cheques received and ACH mandate signed."));
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    /**
+     * Final disbursement. Requires every approval level to actually stand as approved on the stored
+     * record — the last point at which an application could otherwise slip through with a rejected or
+     * still-pending sign-off.
+     */
+    @Transactional
+    public String disburse(final String applicationNo, final String body) {
+        final JsonObject app = pipelineService.loadApplication(applicationNo);
+        final JsonObject input = parseObject(body);
+        requireStage(app, "DISBURSED");
+        require(!"DISBURSED".equals(str(app, "overallStatus")), "This application has already been disbursed.");
+
+        for (final String field : List.of("creditCommitteeApproval", "riskApproval", "legalApproval", "postCheckApproval")) {
+            final JsonObject approval = obj(app, field);
+            final String decision = approval == null ? null : str(approval, "decision");
+            require("APPROVED".equals(decision) || "EXCEPTION_APPROVED".equals(decision),
+                    "Cannot disburse: " + field + " is not approved.");
+        }
+        require(filled(app, "customerSigningDate"), "The customer has not signed the loan agreement.");
+
+        final String mode = strOr(input, "disbursementMode", "Account Credit");
+        app.addProperty("disbursementDate", today());
+        app.addProperty("disbursementMode", mode);
+        if (!filled(app, "achConfirmationRef")) {
+            final String suffix = applicationNo.length() >= 6 ? applicationNo.substring(applicationNo.length() - 6) : applicationNo;
+            app.addProperty("achConfirmationRef", "ACH" + suffix);
+        }
+        app.addProperty("emiActivationConfirmed", true);
+        app.addProperty("emiActivationDate", today());
+        app.addProperty("overallStatus", "DISBURSED");
+        if (LoanOriginationJson.present(input, "fineractLoanId")) {
+            app.addProperty("fineractLoanId", LoanOriginationJson.lng(input, "fineractLoanId"));
+            app.addProperty("fineractLoanAccountNo", str(input, "fineractLoanAccountNo"));
+        }
+
+        appendHistory(app, "DISBURSED", actor(input), "Disbursed", strOr(input, "remarks",
+                "Disbursed via " + mode + " — ACH confirmation " + strOr(app, "achConfirmationRef", "—") + ". EMI activation confirmed."));
+        return pipelineService.storeApplication(applicationNo, app);
+    }
+
+    // ── Shared checklist rules (mirror the Application Detail screen's gating) ─
+
+    private void requireFieldInvestigationComplete(final JsonObject app) {
+        requireCheckVerified(app, "addressVerification", "Address verification");
+        requireCheckVerified(app, "officeVerification", "Office/employment verification");
+        if (bool(app, "secured")) {
+            requireCheckVerified(app, "propertyVerification", "Property verification");
+        }
+        if (bool(app, "hasShop")) {
+            requireCheckVerified(app, "shopVerification", "Shop verification");
+        }
+    }
+
+    private void requireCheckVerified(final JsonObject app, final String key, final String label) {
+        final JsonObject check = obj(app, key);
+        require(check != null && "VERIFIED".equals(str(check, "status")), label + " is not verified.");
+    }
+
+    private void requireCommitteeReportsReady(final JsonObject app, final JsonObject input) {
+        require(bool(app, "cicReportUploaded"), "The credit bureau report is not on file.");
+        require(bool(app, "backgroundCheckDone"), "The background check has not been done.");
+        if (bool(app, "secured")) {
+            require(bool(app, "cersaiSearchDone"), "The CERSAI search has not been done.");
+        }
+        require(bool(app, "aadhaarVerified"), "Aadhaar has not been verified.");
+        require(bool(app, "panVerified"), "PAN has not been verified.");
+        require(bool(app, "incomeProofSubmitted"), "Income proof has not been submitted.");
+        requireFieldInvestigationComplete(app);
+        require(bool(app, "managerMeetingDone"), "The manager meeting has not been recorded.");
+        require(!strOr(input, "resolutionNo", "").isBlank(), "A committee resolution number is required.");
+        require(!strOr(input, "resolutionDate", "").isBlank(), "A committee resolution date is required.");
+    }
+
+    private void requireRiskChecklistReady(final JsonObject app) {
+        requireCheckVerified(app, "addressVerification", "Address verification");
+        require(bool(app, "incomeProofSubmitted"), "Income proof has not been submitted.");
+        require(bool(app, "previousLoanDeclarationDone"), "The previous-loan declaration has not been taken.");
+        if (bool(app, "secured")) {
+            require(bool(app, "propertySearchReportDone"), "The property search report is not on file.");
+            require(bool(app, "valuationReportConfirmed"), "The valuation report has not been confirmed.");
+        }
+        requireFieldInvestigationComplete(app);
+        require(bool(app, "backgroundCheckDone"), "The background check has not been done.");
+        if (bool(app, "guarantorRequired")) {
+            // A guarantor at a co-operative bank has to be an existing member, not just a name: an
+            // onboarded client id AND a live share account.
+            require(LoanOriginationJson.lng(app, "guarantorClientId") != null,
+                    "A guarantor is required but no existing client has been selected.");
+            require(bool(app, "guarantorHasShareAccount"), "The selected guarantor has no active share account.");
+        }
+    }
+
+    private void requireLegalChecklistDone(final JsonObject app) {
+        require(bool(app, "feesAndAccountOpened"), "Fees and account opening are not complete.");
+        if (bool(app, "secured")) {
+            require(bool(app, "mortgageCreated"), "The mortgage has not been created.");
+        }
+        require(bool(app, "legalStampDone"), "Legal stamping is not complete.");
+        require(bool(app, "fileFilingDone"), "File filing is not complete.");
+        for (final JsonElement element : arr(app, "legalDocuments")) {
+            final JsonObject doc = element.getAsJsonObject();
+            require(bool(doc, "submitted"), "Legal document not submitted: " + strOr(doc, "label", strOr(doc, "key", "document")));
+        }
+    }
+
+    private void requirePostCheckSignatures(final JsonObject app) {
+        require(bool(app, "signedByAgent"), "The agent has not signed off.");
+        require(bool(app, "signedByManager"), "The manager has not signed off.");
+        require(bool(app, "signedByCommittee"), "The committee has not signed off.");
+        require(bool(app, "signedByRiskApproval"), "Risk approval has not signed off.");
+        require(bool(app, "signedByLegalApproval"), "Legal approval has not signed off.");
+    }
+
+    // ── Stage / history mechanics ────────────────────────────────────────────
+
+    private void requireStage(final JsonObject app, final String expected) {
+        final String actual = str(app, "currentStage");
+        if (!expected.equals(actual)) {
+            throw badRequest("This action applies at the " + expected + " stage, but the application is at " + actual + ".");
+        }
+        final String status = str(app, "overallStatus");
+        if ("REJECTED".equals(status)) {
+            throw badRequest("This application has been rejected and cannot be progressed.");
+        }
+    }
+
+    /**
+     * Moves the application to the next stage and appends the audit entry. {@code furthestStageIndex}
+     * only ever increases, so jumping back to an earlier stage for a correction does not make
+     * already-completed stages look unfinished.
+     */
+    private void advance(final JsonObject app, final String actionBy, final String outcome, final String remarks) {
+        final String current = str(app, "currentStage");
+        appendHistory(app, current, actionBy, outcome, remarks);
+
+        final int index = STAGE_ORDER.indexOf(current);
+        if (index >= 0 && index < STAGE_ORDER.size() - 1) {
+            final int next = index + 1;
+            app.addProperty("currentStage", STAGE_ORDER.get(next));
+            app.addProperty("furthestStageIndex", Math.max(intOr(app, "furthestStageIndex", 0), next));
+        }
+    }
+
+    private void appendHistory(final JsonObject app, final String stage, final String actionBy, final String outcome,
+            final String remarks) {
+        final JsonArray history = arrOrCreate(app, "stageHistory");
+        final JsonObject entry = new JsonObject();
+        entry.addProperty("stage", stage);
+        entry.addProperty("date", today());
+        entry.addProperty("actionBy", actionBy);
+        entry.addProperty("outcome", outcome);
+        entry.addProperty("remarks", remarks);
+        history.add(entry);
+    }
+
+    private String actor(final JsonObject input) {
+        return strOr(input, "actionBy", "Bank Staff");
+    }
+
+    private String today() {
+        final LocalDate businessDate = DateUtils.getBusinessLocalDate();
+        return (businessDate == null ? LocalDate.now(DateUtils.getDateTimeZoneOfTenant()) : businessDate).format(WORKFLOW_DATE);
+    }
+
+    private void require(final boolean condition, final String message) {
+        if (!condition) {
+            throw badRequest(message);
+        }
+    }
+
+    private GeneralPlatformDomainRuleException badRequest(final String message) {
+        return new GeneralPlatformDomainRuleException("error.msg.loan.origination.stage.invalid", message);
+    }
+
+    /** Kept for symmetry with the check-key list above; used by callers validating a key up front. */
+    public static boolean isKnownFieldCheck(final String checkKey) {
+        return FI_CHECK_KEYS.contains(checkKey);
+    }
+
+    /** Exposed so the API layer can advertise the stage order without duplicating it. */
+    public static List<String> stageOrder() {
+        return Arrays.asList(STAGE_ORDER.toArray(new String[0]));
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/mobilelookup/api/MobileLookupApiResource.java

@@ -18,6 +18,8 @@
  */
 package org.apache.fineract.portfolio.mobilelookup.api;
 
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.media.Content;
@@ -26,11 +28,16 @@ import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Set;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
@@ -63,6 +70,8 @@ public class MobileLookupApiResource {
     private final MobileLookupService mobileLookupService;
     private final DefaultToApiJsonSerializer<MobileLookupResult> resultSerializer;
     private final DefaultToApiJsonSerializer<List> listSerializer;
+    private final DefaultToApiJsonSerializer<MobileLookupLogData> logSerializer;
+    private final DefaultToApiJsonSerializer<Map> mapSerializer;
 
     @GET
     @Path("/check")
@@ -80,6 +89,20 @@ public class MobileLookupApiResource {
             @QueryParam("mobileNumber") @Parameter(description = "Mobile number to check (10-15 digits)") final String mobileNumber) {
         this.context.authenticatedUser().validateHasReadPermission("MOBILE_LOOKUP");
         final MobileLookupResult result = mobileLookupService.checkMobileNumber(mobileNumber);
+
+        // Surface any earlier rejection of the same number so the officer screening it today is
+        // not the only one without that history.
+        final MobileLookupLog priorRejection = mobileLookupService.findPriorRejection(mobileNumber);
+        if (priorRejection != null && !priorRejection.getId().equals(result.getLookupLogId())) {
+            final Map<String, Object> payload = new LinkedHashMap<>();
+            payload.put("lookupLogId", result.getLookupLogId());
+            payload.put("success", result.isSuccess());
+            payload.put("message", result.getMessage());
+            payload.put("data", result.getData());
+            payload.put("timestamp", result.getTimestamp());
+            payload.put("priorRejection", MobileLookupLogData.fromEntity(priorRejection));
+            return mapSerializer.serialize(payload);
+        }
         return resultSerializer.serialize(result);
     }
 
@@ -107,10 +130,77 @@ public class MobileLookupApiResource {
             logs = mobileLookupService.getLookupLogs();
         }
 
-        final List<MobileLookupLogData> logDataList = logs.stream()
+        return listSerializer.serialize(withClientNames(logs));
-                .map(MobileLookupLogData::fromEntity)
+    }
-                .collect(Collectors.toList());
 
-        return listSerializer.serialize(logDataList);
+    /**
+     * Attaches the client's display name and account number to each row. The log stores only the
+     * client id, and a queue of bare ids is not something a reviewing officer can act on.
+     */
+    private List<MobileLookupLogData> withClientNames(final List<MobileLookupLog> logs) {
+        final Set<Long> clientIds = logs.stream()
+                .map(MobileLookupLog::getClientId)
+                .filter(java.util.Objects::nonNull)
+                .collect(Collectors.toSet());
+        final Map<Long, String[]> names = mobileLookupService.resolveClientNames(clientIds);
+
+        return logs.stream().map(log -> {
+            final String[] client = log.getClientId() == null ? null : names.get(log.getClientId());
+            return MobileLookupLogData.fromEntity(log, client == null ? null : client[0],
+                    client == null ? null : client[1]);
+        }).collect(Collectors.toList());
+    }
+
+    @GET
+    @Path("/pending")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Lookups awaiting an officer's decision",
+            description = "SUSPECTED or DISCONNECTED numbers on which no PROCEEDED/REJECTED decision "
+                    + "has been recorded yet.")
+    public String getPendingDecisions() {
+        this.context.authenticatedUser().validateHasReadPermission("MOBILE_LOOKUP");
+
+        return listSerializer.serialize(withClientNames(mobileLookupService.getPendingDecisions()));
+    }
+
+    @POST
+    @Path("/logs/{logId}/decision")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Record the officer's decision on a flagged number",
+            description = "Body: {\"decision\": \"PROCEEDED|REJECTED\", \"reason\": \"...\"}. "
+                    + "A reason is mandatory when proceeding despite a DIP/MNRL hit.")
+    public String recordDecision(@PathParam("logId") final Long logId, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser().validateHasPermissionTo("OVERRIDE_MOBILE_LOOKUP");
+
+        final JsonObject json = JsonParser.parseString(apiRequestBodyAsJson).getAsJsonObject();
+        final String decision = json.has("decision") ? json.get("decision").getAsString() : null;
+        final String reason = json.has("reason") ? json.get("reason").getAsString() : null;
+
+        final MobileLookupLogData result = MobileLookupLogData.fromEntity(mobileLookupService
+                .recordDecision(logId, decision, reason, this.context.authenticatedUser().getId()));
+        return logSerializer.serialize(result);
+    }
+
+    @POST
+    @Path("/rescreen")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Re-screen existing clients' mobile numbers against DIP/MNRL",
+            description = "Screens every active client's mobile and alternate mobile numbers, opening a "
+                    + "decision row for each hit. Detects numbers reported for fraud or reassigned after "
+                    + "the customer was onboarded.")
+    public String rescreenExistingClients() {
+        this.context.authenticatedUser().validateHasPermissionTo("OVERRIDE_MOBILE_LOOKUP");
+
+        final int flagged = mobileLookupService.rescreenExistingClients();
+        final Map<String, Object> response = new LinkedHashMap<>();
+        response.put("message", "DIP/MNRL re-screening complete");
+        response.put("numbersFlagged", flagged);
+        // Reported so "0 flagged" can be told apart from "0 clients were even looked at" — the
+        // two mean very different things and the caller could not previously distinguish them.
+        response.put("clientsScanned", mobileLookupService.countScreenableClients());
+        return mapSerializer.serialize(response);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/mobilelookup/data/MobileLookupLogData.java

@@ -34,9 +34,26 @@ public class MobileLookupLogData {
     private final String responseMessage;
     private final String lookupSource;
     private final Long clientId;
+    /**
+     * Resolved separately from the log row, which stores only the id. A queue showing a bare
+     * "145" gives the reviewing officer nothing to act on — they need to know who it is.
+     */
+    private final String clientName;
+    private final String clientAccountNo;
     private final String lookedUpOn;
+    private final String overrideDecision;
+    private final String overrideReason;
+    private final Long decidedBy;
+    private final String decidedOn;
+    /** Whether this lookup permits the number to be used on a client record. */
+    private final boolean usable;
 
     public static MobileLookupLogData fromEntity(final MobileLookupLog log) {
+        return fromEntity(log, null, null);
+    }
+
+    public static MobileLookupLogData fromEntity(final MobileLookupLog log, final String clientName,
+            final String clientAccountNo) {
         return new MobileLookupLogData(
                 log.getId(),
                 log.getMobileNumber(),
@@ -46,6 +63,13 @@ public class MobileLookupLogData {
                 log.getResponseMessage(),
                 log.getLookupSource(),
                 log.getClientId(),
-                log.getLookedUpOn() != null ? log.getLookedUpOn().toString() : null);
+                clientName,
+                clientAccountNo,
+                log.getLookedUpOn() != null ? log.getLookedUpOn().toString() : null,
+                log.getOverrideDecision(),
+                log.getOverrideReason(),
+                log.getDecidedBy(),
+                log.getDecidedOn() != null ? log.getDecidedOn().toString() : null,
+                log.isUsable());
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/mobilelookup/service/MobileLookupService.java

@@ -33,4 +33,65 @@ public interface MobileLookupService {
     List<MobileLookupLog> getLookupLogsByMobileNumber(String mobileNumber);
 
     List<MobileLookupLog> getLookupLogsByStatus(String status);
+
+    /**
+     * Records the officer's decision on a lookup that came back SUSPECTED or DISCONNECTED.
+     *
+     * @param decision PROCEEDED or REJECTED
+     * @param reason   mandatory when proceeding — why the number is acceptable anyway
+     */
+    MobileLookupLog recordDecision(Long logId, String decision, String reason, Long userId);
+
+    /** Non-clean lookups still awaiting a decision. */
+    List<MobileLookupLog> getPendingDecisions();
+
+    /**
+     * Whether the number's latest lookup permits it to be stored on a client — clean, or a hit
+     * the officer explicitly decided to proceed with. A DoT outage is not a pass.
+     */
+    boolean isMobileNumberUsable(String mobileNumber);
+
+    /** Latest lookup status for the number, or null when it has never been checked. */
+    String getLatestStatus(String mobileNumber);
+
+    /**
+     * The most recent time this number was rejected, on any client, or null if never. A number
+     * turned away once should not be screened as if it had no history.
+     */
+    MobileLookupLog findPriorRejection(String mobileNumber);
+
+    /**
+     * Re-screens every active client's mobile numbers against DIP/MNRL, opening a decision row
+     * for each hit.
+     *
+     * <p>
+     * Onboarding-time screening only ever sees a number as it is typed. A number reported for
+     * fraud, or disconnected and reassigned, after the customer was onboarded is otherwise never
+     * detected — and that is precisely the case where the bank's OTPs start reaching a stranger.
+     * </p>
+     *
+     * @return count of numbers that came back flagged
+     */
+    int rescreenExistingClients();
+
+    /**
+     * Display name and account number for the given client ids, keyed by id. Resolved in one
+     * query so a queue of lookups does not issue a round trip per row.
+     */
+    java.util.Map<Long, String[]> resolveClientNames(java.util.Collection<Long> clientIds);
+
+    /** How many clients the re-screen sweep would look at — lets "0 flagged" be interpreted. */
+    int countScreenableClients();
+
+    /**
+     * Marks every open alert on a number as resolved, recording why.
+     *
+     * <p>
+     * Called when the number is replaced on a client: the alert then refers to a number the bank
+     * no longer uses, and leaving it "Awaiting Decision" would misrepresent it as outstanding work.
+     * </p>
+     *
+     * @return how many alerts were closed
+     */
+    int closeOpenAlerts(String mobileNumber, Long clientId, String reason);
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/mobilelookup/service/MobileLookupServiceImpl.java

@@ -21,8 +21,13 @@ package org.apache.fineract.portfolio.mobilelookup.service;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
+import java.util.Collection;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
+import java.util.stream.Collectors;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
 import org.apache.fineract.portfolio.mobilelookup.data.MobileLookupDetailData;
 import org.apache.fineract.portfolio.mobilelookup.data.MobileLookupResult;
 import org.apache.fineract.portfolio.mobilelookup.domain.MobileLookupLog;
@@ -30,6 +35,8 @@ import org.apache.fineract.portfolio.mobilelookup.domain.MobileLookupLogReposito
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import org.springframework.web.client.RestTemplate;
@@ -50,15 +57,26 @@ public class MobileLookupServiceImpl implements MobileLookupService {
             "9752123456", "9752345678", "9752987654"
     );
 
+    /** Demo numbers that always return DISCONNECTED (found on the MNRL) without calling the external API. */
+    private static final Set<String> DEMO_DISCONNECTED_NUMBERS = Set.of("9000000001", "9000000002");
+
+    /** Demo numbers that always return SUSPECTED_AND_DISCONNECTED without calling the external API. */
+    private static final Set<String> DEMO_SUSPECTED_AND_DISCONNECTED_NUMBERS = Set.of("9000000003");
+
     private final String baseUrl;
+    private final boolean enabled;
     private final RestTemplate restTemplate;
     private final MobileLookupLogRepository logRepository;
+    private final JdbcTemplate jdbcTemplate;
 
     public MobileLookupServiceImpl(@Value("${fineract.mobile-lookup.base-url}") String baseUrl,
-            MobileLookupLogRepository logRepository) {
+            @Value("${fineract.mobile-lookup.enabled:true}") boolean enabled,
+            MobileLookupLogRepository logRepository, JdbcTemplate jdbcTemplate) {
         this.baseUrl = baseUrl;
+        this.enabled = enabled;
         this.restTemplate = new RestTemplate();
         this.logRepository = logRepository;
+        this.jdbcTemplate = jdbcTemplate;
     }
 
     @Override
@@ -94,6 +112,39 @@ public class MobileLookupServiceImpl implements MobileLookupService {
             return MobileLookupResult.clean(logId, trimmed);
         }
 
+        // Demo numbers — return DISCONNECTED (on the MNRL) without calling the external API
+        if (isDemoDisconnectedNumber(trimmed)) {
+            LOG.info("Demo disconnected number detected: {}", trimmed);
+            final MobileLookupDetailData disconnectedDetail = MobileLookupDetailData.forDisconnected(
+                    "Number revoked and listed on MNRL (demo data)", "DEMO");
+            final Long logId = saveLog(trimmed, "DISCONNECTED", false, true,
+                    "Number is DISCONNECTED — found in MNRL records", null, source, clientId);
+            return MobileLookupResult.disconnected(logId, trimmed, disconnectedDetail);
+        }
+
+        // Demo numbers — return SUSPECTED_AND_DISCONNECTED without calling the external API
+        if (isDemoSuspectedAndDisconnectedNumber(trimmed)) {
+            LOG.info("Demo suspected+disconnected number detected: {}", trimmed);
+            final MobileLookupDetailData suspectedDetail = MobileLookupDetailData.forSuspected(
+                    "active", "Demo DIP suspected number", "DEMO");
+            final MobileLookupDetailData disconnectedDetail = MobileLookupDetailData.forDisconnected(
+                    "Number revoked and listed on MNRL (demo data)", "DEMO");
+            final Long logId = saveLog(trimmed, "SUSPECTED_AND_DISCONNECTED", true, true,
+                    "Number is SUSPECTED and DISCONNECTED — found in both DIP and MNRL records", null, source, clientId);
+            return MobileLookupResult.suspectedAndDisconnected(logId, trimmed, suspectedDetail, disconnectedDetail);
+        }
+
+        // Lookup switched off by config (fineract.mobile-lookup.enabled=false) -- skip the external
+        // call entirely rather than fail with a connection error. Logged distinctly from a genuine
+        // CLEAN result so it can never be mistaken for one in an audit trail.
+        if (!enabled) {
+            LOG.info("DIP/MNRL lookup is disabled by configuration — skipping check for {}", trimmed);
+            final Long logId = saveLog(trimmed, MobileLookupLog.STATUS_CLEAN, false, false,
+                    "DIP/MNRL lookup is disabled by configuration — the number was not actually checked.",
+                    "{\"provider\":\"LOOKUP_DISABLED_BY_CONFIG\"}", source, clientId);
+            return MobileLookupResult.clean(logId, trimmed);
+        }
+
         final String url = baseUrl + "/api/v1/lookup/check?mobileNumber=" + trimmed;
 
         LOG.info("Calling DIP/MNRL lookup API: {}", url);
@@ -113,13 +164,194 @@ public class MobileLookupServiceImpl implements MobileLookupService {
                     parsed.getData(), parsed.getTimestamp());
         } catch (Exception e) {
             LOG.error("Failed to call DIP/MNRL lookup API for {}: {}", trimmed, e.getMessage());
-            final Long logId = saveLog(trimmed, "ERROR", false, false,
+            // An unreachable DoT service means the number was NOT checked. It is logged under its
-                    e.getMessage(), rawResponse, source, clientId);
+            // own status rather than ERROR so the queue can distinguish "we could not verify" from
+            // "the lookup itself failed", and it is never presented to the officer as a pass.
+            final Long logId = saveLog(trimmed, MobileLookupLog.STATUS_SERVICE_UNAVAILABLE, false, false,
+                    "DIP/MNRL lookup service is unavailable — the number could not be verified.",
+                    rawResponse, source, clientId);
             return MobileLookupResult.serviceUnavailable(logId, trimmed,
-                    "DIP/MNRL lookup service is unavailable. Number treated as CLEAN by default.");
+                    "DIP/MNRL lookup service is unavailable — the number could not be verified.");
         }
     }
 
+    @Override
+    @Transactional
+    public MobileLookupLog recordDecision(final Long logId, final String decision, final String reason,
+            final Long userId) {
+        final MobileLookupLog log = logRepository.findById(logId)
+                .orElseThrow(() -> new GeneralPlatformDomainRuleException("error.msg.mobile.lookup.not.found",
+                        "Mobile lookup " + logId + " does not exist."));
+
+        final String normalised = decision == null ? "" : decision.trim().toUpperCase();
+        if (!MobileLookupLog.DECISION_PROCEEDED.equals(normalised)
+                && !MobileLookupLog.DECISION_REJECTED.equals(normalised)) {
+            throw new GeneralPlatformDomainRuleException("error.msg.mobile.lookup.decision.invalid",
+                    "Decision must be PROCEEDED or REJECTED.");
+        }
+        // Proceeding past a DIP hit is the judgement call that has to survive an audit, so it
+        // cannot be recorded without the officer's reasoning. Rejecting needs no justification.
+        if (MobileLookupLog.DECISION_PROCEEDED.equals(normalised) && (reason == null || reason.trim().length() < 10)) {
+            throw new GeneralPlatformDomainRuleException("error.msg.mobile.lookup.reason.required",
+                    "Record why this number is acceptable despite the DIP/MNRL result (minimum 10 characters).");
+        }
+
+        log.recordDecision(normalised, reason == null ? null : reason.trim(), userId);
+        logRepository.saveAndFlush(log);
+        LOG.warn("Mobile lookup {} for {} decided as {}", logId, log.getMobileNumber(), normalised);
+        return log;
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public List<MobileLookupLog> getPendingDecisions() {
+        return logRepository.findPendingDecisions();
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public boolean isMobileNumberUsable(final String mobileNumber) {
+        if (mobileNumber == null || mobileNumber.isBlank()) {
+            return true;
+        }
+        final MobileLookupLog latest = findLatest(mobileNumber.trim());
+        // No lookup on record is handled by the caller (it decides whether a check is mandatory);
+        // here only an actual result can veto.
+        return latest == null || latest.isUsable();
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public String getLatestStatus(final String mobileNumber) {
+        if (mobileNumber == null || mobileNumber.isBlank()) {
+            return null;
+        }
+        final MobileLookupLog latest = findLatest(mobileNumber.trim());
+        return latest == null ? null : latest.getLookupStatus();
+    }
+
+    /** Newest lookup row for a number, or null when it has never been checked. */
+    private MobileLookupLog findLatest(final String mobileNumber) {
+        final List<MobileLookupLog> rows = logRepository.findLatestByMobileNumber(mobileNumber, PageRequest.of(0, 1));
+        return rows.isEmpty() ? null : rows.get(0);
+    }
+
+    @Override
+    @Transactional
+    public int rescreenExistingClients() {
+        // Active clients only (status 300). A pending client is still inside the onboarding flow,
+        // where the number is screened as it is entered; this sweep exists for the customers that
+        // flow has already finished with. Closed/rejected/withdrawn have no live relationship.
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
+                "SELECT id, mobile_no, alternate_mobile_no FROM m_client WHERE status_enum = 300 "
+                        + "AND (mobile_no IS NOT NULL OR alternate_mobile_no IS NOT NULL)");
+
+        LOG.info("DIP/MNRL re-screening starting for {} client(s) with a number on file", rows.size());
+
+        int flagged = 0;
+        for (final Map<String, Object> row : rows) {
+            final Long clientId = ((Number) row.get("id")).longValue();
+            flagged += rescreenNumber((String) row.get("mobile_no"), clientId);
+            flagged += rescreenNumber((String) row.get("alternate_mobile_no"), clientId);
+        }
+        LOG.info("DIP/MNRL re-screening complete: {} number(s) flagged across {} clients", flagged, rows.size());
+        return flagged;
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public int countScreenableClients() {
+        final Integer count = jdbcTemplate.queryForObject(
+                "SELECT COUNT(*) FROM m_client WHERE status_enum = 300 "
+                        + "AND (mobile_no IS NOT NULL OR alternate_mobile_no IS NOT NULL)",
+                Integer.class);
+        return count == null ? 0 : count;
+    }
+
+    /** Screens one number, tolerating per-number failure so one bad row cannot abort the sweep. */
+    private int rescreenNumber(final String mobileNumber, final Long clientId) {
+        if (mobileNumber == null || mobileNumber.isBlank()) {
+            return 0;
+        }
+        final String trimmed = mobileNumber.trim();
+
+        // Re-running the sweep must not stack another identical alert onto the queue. An open
+        // alert for this number and client is the same case still awaiting the same decision;
+        // duplicating it buries the real work under repeats of itself. A number already decided
+        // is likewise left alone until its value or decision changes.
+        final MobileLookupLog existing = findLatest(trimmed);
+        if (existing != null && existing.requiresDecision() && java.util.Objects.equals(existing.getClientId(), clientId)) {
+            LOG.debug("Skipping re-screen of {} for client {} — an open alert already exists", trimmed, clientId);
+            return 0;
+        }
+
+        try {
+            final MobileLookupResult result = checkMobileNumber(trimmed, "PERIODIC_RESCREEN", clientId);
+            final boolean hit = result.getData() != null
+                    && (result.getData().isSuspected() || result.getData().isDisconnected());
+            return hit ? 1 : 0;
+        } catch (Exception e) {
+            LOG.error("Re-screening failed for {} (client {}): {}", mobileNumber, clientId, e.getMessage());
+            return 0;
+        }
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public Map<Long, String[]> resolveClientNames(final Collection<Long> clientIds) {
+        final Map<Long, String[]> byId = new HashMap<>();
+        if (clientIds == null || clientIds.isEmpty()) {
+            return byId;
+        }
+        final String placeholders = clientIds.stream().map(id -> "?").collect(Collectors.joining(","));
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
+                "SELECT id, display_name, account_no FROM m_client WHERE id IN (" + placeholders + ")",
+                clientIds.toArray());
+
+        for (final Map<String, Object> row : rows) {
+            final Long id = ((Number) row.get("id")).longValue();
+            byId.put(id, new String[] { (String) row.get("display_name"), (String) row.get("account_no") });
+        }
+        return byId;
+    }
+
+    @Override
+    @Transactional
+    public int closeOpenAlerts(final String mobileNumber, final Long clientId, final String reason) {
+        if (mobileNumber == null || mobileNumber.isBlank()) {
+            return 0;
+        }
+        final List<MobileLookupLog> open = logRepository.findByMobileNumber(mobileNumber.trim()).stream()
+                .filter(MobileLookupLog::requiresDecision)
+                .filter(log -> log.getOverrideDecision() == null)
+                .collect(Collectors.toList());
+
+        for (final MobileLookupLog log : open) {
+            // REJECTED is the correct terminal state: the bank turned this number away. It also
+            // keeps isMobileNumberUsable() false, so the number cannot quietly come back into use.
+            log.recordDecision(MobileLookupLog.DECISION_REJECTED, reason, null);
+            if (log.getClientId() == null && clientId != null) {
+                log.setClientId(clientId);
+            }
+        }
+        if (!open.isEmpty()) {
+            logRepository.saveAll(open);
+            logRepository.flush();
+            LOG.info("Closed {} open DIP alert(s) for replaced number {} on client {}", open.size(), mobileNumber, clientId);
+        }
+        return open.size();
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public MobileLookupLog findPriorRejection(final String mobileNumber) {
+        if (mobileNumber == null || mobileNumber.isBlank()) {
+            return null;
+        }
+        final List<MobileLookupLog> rejections = logRepository.findRejections(mobileNumber.trim(), PageRequest.of(0, 1));
+        return rejections.isEmpty() ? null : rejections.get(0);
+    }
+
     @Override
     @Transactional(readOnly = true)
     public List<MobileLookupLog> getLookupLogs() {
@@ -212,6 +444,26 @@ public class MobileLookupServiceImpl implements MobileLookupService {
         return false;
     }
 
+    private boolean isDemoDisconnectedNumber(final String mobileNumber) {
+        if (DEMO_DISCONNECTED_NUMBERS.contains(mobileNumber)) {
+            return true;
+        }
+        if (mobileNumber.startsWith("91") && mobileNumber.length() > 10) {
+            return DEMO_DISCONNECTED_NUMBERS.contains(mobileNumber.substring(2));
+        }
+        return false;
+    }
+
+    private boolean isDemoSuspectedAndDisconnectedNumber(final String mobileNumber) {
+        if (DEMO_SUSPECTED_AND_DISCONNECTED_NUMBERS.contains(mobileNumber)) {
+            return true;
+        }
+        if (mobileNumber.startsWith("91") && mobileNumber.length() > 10) {
+            return DEMO_SUSPECTED_AND_DISCONNECTED_NUMBERS.contains(mobileNumber.substring(2));
+        }
+        return false;
+    }
+
     private String getStringOrNull(JsonObject json, String key) {
         JsonElement el = json.get(key);
         return (el != null && !el.isJsonNull()) ? el.getAsString() : null;

fineract-provider/src/main/java/org/apache/fineract/portfolio/sanctions/api/SanctionsScreeningApiResource.java

@@ -28,6 +28,7 @@ import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
@@ -35,6 +36,7 @@ import java.io.InputStream;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
@@ -77,6 +79,7 @@ public class SanctionsScreeningApiResource {
     private final DefaultToApiJsonSerializer<SanctionsScreeningResult> screeningResultSerializer;
     private final DefaultToApiJsonSerializer<Map> mapSerializer;
     private final DefaultToApiJsonSerializer<List> listSerializer;
+    private final DefaultToApiJsonSerializer<SanctionsScreeningLogData> logSerializer;
 
     @GET
     @Path("/screen")
@@ -184,10 +187,124 @@ public class SanctionsScreeningApiResource {
             logs = sanctionsScreeningService.getScreeningLogs();
         }
 
-        final List<SanctionsScreeningLogData> logDataList = logs.stream()
+        return listSerializer.serialize(withClientNames(logs));
-                .map(SanctionsScreeningLogData::fromEntity)
+    }
-                .collect(Collectors.toList());
 
-        return listSerializer.serialize(logDataList);
+    /**
+     * Attaches the client's display name and account number to each row. The log stores only the
+     * client id, and a queue of bare ids is not something a reviewing officer can act on.
+     */
+    private List<SanctionsScreeningLogData> withClientNames(final List<SanctionsScreeningLog> logs) {
+        final Set<Long> clientIds = logs.stream().map(SanctionsScreeningLog::getClientId).filter(java.util.Objects::nonNull)
+                .collect(Collectors.toSet());
+        final Map<Long, String[]> names = sanctionsScreeningService.resolveClientNames(clientIds);
+
+        return logs.stream().map(log -> {
+            final String[] client = log.getClientId() == null ? null : names.get(log.getClientId());
+            return SanctionsScreeningLogData.fromEntity(log, client == null ? null : client[0],
+                    client == null ? null : client[1]);
+        }).collect(Collectors.toList());
+    }
+
+    // ── Alert disposition ─────────────────────────────────────────────────────
+    // A flagged screening is a case, not a verdict. These endpoints close it out: the reviewing
+    // officer records whether it is the same person, the Principal Officer signs off, and a
+    // confirmed match carries the FIU-IND / nodal officer reporting references.
+
+    @GET
+    @Path("/alerts")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List sanctions alerts",
+            description = "Flagged screenings and their disposition state. Filter with "
+                    + "?status=PENDING_REVIEW | FALSE_POSITIVE | CONFIRMED_MATCH.")
+    public String getAlerts(
+            @QueryParam("status") @Parameter(description = "Filter by disposition") final String status) {
+        this.context.authenticatedUser().validateHasReadPermission("SANCTIONS");
+
+        return listSerializer.serialize(withClientNames(sanctionsScreeningService.getAlerts(status)));
+    }
+
+    @POST
+    @Path("/alerts/{logId}/disposition")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Record the review outcome of a sanctions alert",
+            description = "Body: {\"disposition\": \"FALSE_POSITIVE|CONFIRMED_MATCH\", \"reason\": \"...\"}. "
+                    + "A false positive does not unblock onboarding until it is approved.")
+    public String recordDisposition(@PathParam("logId") final Long logId, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser().validateHasPermissionTo("DISPOSE_SANCTIONS");
+
+        final com.google.gson.JsonObject json = com.google.gson.JsonParser.parseString(apiRequestBodyAsJson).getAsJsonObject();
+        final String disposition = json.has("disposition") ? json.get("disposition").getAsString() : null;
+        final String reason = json.has("reason") ? json.get("reason").getAsString() : null;
+
+        final SanctionsScreeningLogData result = SanctionsScreeningLogData
+                .fromEntity(sanctionsScreeningService.recordDisposition(logId, disposition, reason));
+        return logSerializer.serialize(result);
+    }
+
+    @POST
+    @Path("/alerts/{logId}/approve")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Principal Officer approval of an alert disposition",
+            description = "Approving a FALSE_POSITIVE clears the name for onboarding. Approving a "
+                    + "CONFIRMED_MATCH freezes debits on every active deposit account of the client.")
+    public String approveAlert(@PathParam("logId") final Long logId) {
+        this.context.authenticatedUser().validateHasPermissionTo("APPROVE_SANCTIONS");
+
+        final SanctionsScreeningLogData result = SanctionsScreeningLogData
+                .fromEntity(sanctionsScreeningService.approveDisposition(logId));
+        return logSerializer.serialize(result);
+    }
+
+    @POST
+    @Path("/alerts/{logId}/report")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Record FIU-IND / nodal officer reporting for a confirmed match",
+            description = "Body: {\"fiuStrReference\": \"...\", \"nodalOfficerInformedOn\": \"yyyy-MM-dd\"}")
+    public String recordReporting(@PathParam("logId") final Long logId, final String apiRequestBodyAsJson) {
+        this.context.authenticatedUser().validateHasPermissionTo("APPROVE_SANCTIONS");
+
+        final com.google.gson.JsonObject json = com.google.gson.JsonParser.parseString(apiRequestBodyAsJson).getAsJsonObject();
+        final String strReference = json.has("fiuStrReference") ? json.get("fiuStrReference").getAsString() : null;
+        final String informedOn = json.has("nodalOfficerInformedOn") ? json.get("nodalOfficerInformedOn").getAsString() : null;
+
+        final SanctionsScreeningLogData result = SanctionsScreeningLogData
+                .fromEntity(sanctionsScreeningService.recordReporting(logId, strReference, informedOn));
+        return logSerializer.serialize(result);
+    }
+
+    @GET
+    @Path("/str-cases")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Sanctions STR cases for the FIU-IND screen",
+            description = "Confirmed matches carrying a reporting obligation. Filter with "
+                    + "?status=PENDING_FILING | FILED. Kept separate from transaction-driven AML alerts.")
+    public String getStrCases(
+            @QueryParam("status") @Parameter(description = "PENDING_FILING or FILED") final String status) {
+        this.context.authenticatedUser().validateHasReadPermission("SANCTIONS");
+
+        return listSerializer.serialize(withClientNames(sanctionsScreeningService.getStrCases(status)));
+    }
+
+    @POST
+    @Path("/rescreen")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Re-screen all existing clients against the current list snapshot",
+            description = "Opens a PENDING_REVIEW alert for every existing client that now matches. "
+                    + "This is what detects a customer added to the list after onboarding.")
+    public String rescreenExistingClients() {
+        this.context.authenticatedUser().validateHasPermissionTo("LOAD_SANCTIONS");
+
+        final int flagged = sanctionsScreeningService.rescreenExistingClients();
+        final Map<String, Object> response = new HashMap<>();
+        response.put("message", "Re-screening complete");
+        response.put("clientsFlagged", flagged);
+        return mapSerializer.serialize(response);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/sanctions/data/SanctionsScreeningLogData.java

@@ -34,14 +34,38 @@ public final class SanctionsScreeningLogData {
     private final String matchedNames;
     private final String screeningSource;
     private final Long clientId;
+    /**
+     * Resolved separately from the log row, which stores only the id. A queue showing a bare
+     * "124" gives the reviewing officer nothing to act on — they need to know who it is.
+     */
+    private final String clientName;
+    private final String clientAccountNo;
     private final String ipAddress;
     private final OffsetDateTime screenedOn;
     private final Long screenedBy;
+    private final String disposition;
+    private final String dispositionReason;
+    private final Long reviewedBy;
+    private final OffsetDateTime reviewedOn;
+    private final Long approvedBy;
+    private final OffsetDateTime approvedOn;
+    private final String fiuStrReference;
+    private final OffsetDateTime nodalOfficerInformedOn;
+    private final String frozenAccountIds;
+    private final OffsetDateTime frozenOn;
+    private final String strStatus;
+    private final String strDueDate;
+    private final String strRaisedOn;
 
     public SanctionsScreeningLogData(final Long id, final String screenedName, final String screeningResult,
             final Integer matchCount, final String matchedEntryIds, final String matchedNames,
-            final String screeningSource, final Long clientId, final String ipAddress,
+            final String screeningSource, final Long clientId, final String clientName, final String clientAccountNo,
-            final OffsetDateTime screenedOn, final Long screenedBy) {
+            final String ipAddress,
+            final OffsetDateTime screenedOn, final Long screenedBy, final String disposition,
+            final String dispositionReason, final Long reviewedBy, final OffsetDateTime reviewedOn,
+            final Long approvedBy, final OffsetDateTime approvedOn, final String fiuStrReference,
+            final OffsetDateTime nodalOfficerInformedOn, final String frozenAccountIds,
+            final OffsetDateTime frozenOn, final String strStatus, final String strDueDate, final String strRaisedOn) {
         this.id = id;
         this.screenedName = screenedName;
         this.screeningResult = screeningResult;
@@ -50,12 +74,32 @@ public final class SanctionsScreeningLogData {
         this.matchedNames = matchedNames;
         this.screeningSource = screeningSource;
         this.clientId = clientId;
+        this.clientName = clientName;
+        this.clientAccountNo = clientAccountNo;
         this.ipAddress = ipAddress;
         this.screenedOn = screenedOn;
         this.screenedBy = screenedBy;
+        this.disposition = disposition;
+        this.dispositionReason = dispositionReason;
+        this.reviewedBy = reviewedBy;
+        this.reviewedOn = reviewedOn;
+        this.approvedBy = approvedBy;
+        this.approvedOn = approvedOn;
+        this.fiuStrReference = fiuStrReference;
+        this.nodalOfficerInformedOn = nodalOfficerInformedOn;
+        this.frozenAccountIds = frozenAccountIds;
+        this.frozenOn = frozenOn;
+        this.strStatus = strStatus;
+        this.strDueDate = strDueDate;
+        this.strRaisedOn = strRaisedOn;
     }
 
     public static SanctionsScreeningLogData fromEntity(final SanctionsScreeningLog log) {
+        return fromEntity(log, null, null);
+    }
+
+    public static SanctionsScreeningLogData fromEntity(final SanctionsScreeningLog log, final String clientName,
+            final String clientAccountNo) {
         return new SanctionsScreeningLogData(
                 log.getId(),
                 log.getScreenedName(),
@@ -65,9 +109,24 @@ public final class SanctionsScreeningLogData {
                 log.getMatchedNames(),
                 log.getScreeningSource(),
                 log.getClientId(),
+                clientName,
+                clientAccountNo,
                 log.getIpAddress(),
                 log.getScreenedOn(),
-                log.getCreatedBy().orElse(null)
+                log.getCreatedBy().orElse(null),
+                log.getDisposition(),
+                log.getDispositionReason(),
+                log.getReviewedBy(),
+                log.getReviewedOn(),
+                log.getApprovedBy(),
+                log.getApprovedOn(),
+                log.getFiuStrReference(),
+                log.getNodalOfficerInformedOn(),
+                log.getFrozenAccountIds(),
+                log.getFrozenOn(),
+                log.getStrStatus(),
+                log.getStrDueDate() != null ? log.getStrDueDate().toString() : null,
+                log.getStrRaisedOn() != null ? log.getStrRaisedOn().toString() : null
         );
     }
 
@@ -79,7 +138,22 @@ public final class SanctionsScreeningLogData {
     public String getMatchedNames() { return matchedNames; }
     public String getScreeningSource() { return screeningSource; }
     public Long getClientId() { return clientId; }
+    public String getClientName() { return clientName; }
+    public String getClientAccountNo() { return clientAccountNo; }
     public String getIpAddress() { return ipAddress; }
     public OffsetDateTime getScreenedOn() { return screenedOn; }
     public Long getScreenedBy() { return screenedBy; }
+    public String getDisposition() { return disposition; }
+    public String getDispositionReason() { return dispositionReason; }
+    public Long getReviewedBy() { return reviewedBy; }
+    public OffsetDateTime getReviewedOn() { return reviewedOn; }
+    public Long getApprovedBy() { return approvedBy; }
+    public OffsetDateTime getApprovedOn() { return approvedOn; }
+    public String getFiuStrReference() { return fiuStrReference; }
+    public OffsetDateTime getNodalOfficerInformedOn() { return nodalOfficerInformedOn; }
+    public String getFrozenAccountIds() { return frozenAccountIds; }
+    public OffsetDateTime getFrozenOn() { return frozenOn; }
+    public String getStrStatus() { return strStatus; }
+    public String getStrDueDate() { return strDueDate; }
+    public String getStrRaisedOn() { return strRaisedOn; }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/sanctions/service/SanctionsFreezeService.java

@@ -0,0 +1,117 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.sanctions.service;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Collectors;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccount;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccountRepository;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccountStatusType;
+import org.apache.fineract.portfolio.savings.domain.SavingsAccountSubStatusEnum;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+/**
+ * Freezes and releases a client's deposit accounts when a UNSC sanctions match is confirmed.
+ *
+ * <p>
+ * Under Section 51-A UAPA 1967 a confirmed match means funds may not move OUT — the account is
+ * not closed and incoming credits are not refused, so this applies a debit block rather than a
+ * full account block. Freezing is only reachable for a client that already exists; a match at
+ * onboarding has no account to freeze and is handled by refusing to create the client at all.
+ * </p>
+ */
+@Service
+@RequiredArgsConstructor
+public class SanctionsFreezeService {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SanctionsFreezeService.class);
+
+    private final SavingsAccountRepository savingsAccountRepository;
+
+    /**
+     * Blocks debits on every active savings account of the client.
+     *
+     * @return comma-separated ids of the accounts actually frozen (empty string when the client
+     *         has no active account — a legitimate outcome, not an error)
+     */
+    @Transactional
+    public String freezeClientAccounts(final Long clientId, final Long alertId) {
+        if (clientId == null) {
+            return "";
+        }
+        final List<SavingsAccount> accounts = savingsAccountRepository.findSavingAccountByClientId(clientId);
+        final List<String> frozen = new ArrayList<>();
+
+        for (final SavingsAccount account : accounts) {
+            // blockDebits() rejects anything not ACTIVE and anything already fully blocked. Filter
+            // here rather than catching, so a closed or already-frozen account is a skip, not noise.
+            if (!SavingsAccountStatusType.ACTIVE.hasStateOf(account.getStatus())) {
+                continue;
+            }
+            final SavingsAccountSubStatusEnum subStatus = SavingsAccountSubStatusEnum.fromInt(account.getSubStatus());
+            if (SavingsAccountSubStatusEnum.BLOCK.hasStateOf(subStatus)
+                    || SavingsAccountSubStatusEnum.BLOCK_DEBIT.hasStateOf(subStatus)) {
+                frozen.add(String.valueOf(account.getId()));
+                continue;
+            }
+            try {
+                account.blockDebits(account.getSubStatus());
+                savingsAccountRepository.save(account);
+                frozen.add(String.valueOf(account.getId()));
+                LOG.warn("Sanctions alert {}: debits blocked on savings account {} of client {}", alertId, account.getId(),
+                        clientId);
+            } catch (Exception e) {
+                // One un-freezable account must not abort the freeze of the others.
+                LOG.error("Sanctions alert {}: could not block debits on savings account {}: {}", alertId, account.getId(),
+                        e.getMessage());
+            }
+        }
+        return frozen.stream().collect(Collectors.joining(","));
+    }
+
+    /**
+     * Releases the debit block. Only ever called on de-listing or revocation of the order, and
+     * only from the Principal Officer approval path.
+     */
+    @Transactional
+    public void unfreezeClientAccounts(final Long clientId) {
+        if (clientId == null) {
+            return;
+        }
+        for (final SavingsAccount account : savingsAccountRepository.findSavingAccountByClientId(clientId)) {
+            final SavingsAccountSubStatusEnum subStatus = SavingsAccountSubStatusEnum.fromInt(account.getSubStatus());
+            if (!(SavingsAccountSubStatusEnum.BLOCK_DEBIT.hasStateOf(subStatus)
+                    || SavingsAccountSubStatusEnum.BLOCK.hasStateOf(subStatus))) {
+                continue;
+            }
+            try {
+                account.unblockDebits();
+                savingsAccountRepository.save(account);
+                LOG.info("Debits released on savings account {} of client {}", account.getId(), clientId);
+            } catch (Exception e) {
+                LOG.error("Could not release debits on savings account {}: {}", account.getId(), e.getMessage());
+            }
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/sanctions/service/SanctionsScreeningService.java

@@ -59,4 +59,77 @@ public interface SanctionsScreeningService {
      * Search screening logs by screened name.
      */
     List<SanctionsScreeningLog> searchScreeningLogs(String name);
+
+    /**
+     * Alerts awaiting or carrying a disposition. Pass null for every alert regardless of state.
+     */
+    List<SanctionsScreeningLog> getAlerts(String disposition);
+
+    /**
+     * Records the reviewing officer's assessment of a flagged screening.
+     *
+     * @param logId       the flagged screening log id
+     * @param disposition FALSE_POSITIVE or CONFIRMED_MATCH
+     * @param reason      mandatory narrative of the identifier comparison
+     */
+    SanctionsScreeningLog recordDisposition(Long logId, String disposition, String reason);
+
+    /**
+     * Principal Officer sign-off. Approving a FALSE_POSITIVE is what actually unblocks
+     * onboarding; approving a CONFIRMED_MATCH triggers the freeze of the client's accounts.
+     */
+    SanctionsScreeningLog approveDisposition(Long logId);
+
+    /**
+     * Records the FIU-IND STR reference and the date the nodal officer was informed, closing
+     * out the 24-hour reporting obligation on a confirmed match.
+     */
+    SanctionsScreeningLog recordReporting(Long logId, String strReference, String nodalOfficerInformedOn);
+
+    /**
+     * True when this exact name carries a false positive that the Principal Officer approved —
+     * the only condition under which a matched name may be onboarded.
+     */
+    boolean hasApprovedFalsePositive(String name);
+
+    /**
+     * Match check that does NOT write an activity log entry.
+     *
+     * <p>
+     * Used by the server-side onboarding gate, which runs on every save attempt: logging there
+     * would stack a fresh alert onto the queue each time the officer retries a blocked client,
+     * burying the one real case under duplicates. The screening that belongs in the log is the
+     * one the officer deliberately ran from the UI.
+     * </p>
+     */
+    boolean isNameSanctioned(String name);
+
+    /**
+     * Re-screens every existing client against the currently loaded list snapshot, opening an
+     * alert for each hit. This is what makes freezing reachable at all: without it a customer
+     * added to the list after onboarding is never detected.
+     *
+     * @return number of clients that produced a new flagged alert
+     */
+    int rescreenExistingClients();
+
+    /**
+     * Display name and account number for the given client ids, keyed by id. Resolved in one
+     * query so a queue of alerts does not issue a round trip per row.
+     */
+    java.util.Map<Long, String[]> resolveClientNames(java.util.Collection<Long> clientIds);
+
+    /**
+     * Disposition of the client's most recent flagged alert (PENDING_REVIEW / FALSE_POSITIVE /
+     * CONFIRMED_MATCH), or null when they carry none. Drives the badge on the client's own page.
+     */
+    String getLatestAlertStatus(Long clientId);
+
+    /**
+     * Confirmed matches carrying an STR obligation — the sanctions stream shown on the FIU-IND
+     * screen, deliberately separate from transaction-driven AML alerts.
+     *
+     * @param status PENDING_FILING or FILED; null for all
+     */
+    List<SanctionsScreeningLog> getStrCases(String status);
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/sanctions/service/SanctionsScreeningServiceImpl.java

@@ -18,10 +18,19 @@
  */
 package org.apache.fineract.portfolio.sanctions.service;
 
+import java.time.LocalDate;
 import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeParseException;
+import java.util.Collection;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.sanctions.data.SanctionsMatchData;
 import org.apache.fineract.portfolio.sanctions.data.SanctionsScreeningResult;
 import org.apache.fineract.portfolio.sanctions.domain.SanctionsAlias;
@@ -31,6 +40,7 @@ import org.apache.fineract.portfolio.sanctions.domain.SanctionsScreeningLog;
 import org.apache.fineract.portfolio.sanctions.domain.SanctionsScreeningLogRepository;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -42,6 +52,9 @@ public class SanctionsScreeningServiceImpl implements SanctionsScreeningService
 
     private final SanctionsEntryRepository sanctionsEntryRepository;
     private final SanctionsScreeningLogRepository screeningLogRepository;
+    private final SanctionsFreezeService sanctionsFreezeService;
+    private final PlatformSecurityContext context;
+    private final JdbcTemplate jdbcTemplate;
 
     @Override
     @Transactional
@@ -113,6 +126,288 @@ public class SanctionsScreeningServiceImpl implements SanctionsScreeningService
         return screeningLogRepository.findByScreenedNameContaining(name);
     }
 
+    // ── Alert disposition ─────────────────────────────────────────────────────
+
+    @Override
+    @Transactional(readOnly = true)
+    public List<SanctionsScreeningLog> getAlerts(final String disposition) {
+        if (disposition == null || disposition.isBlank()) {
+            return screeningLogRepository.findAllAlerts();
+        }
+        return screeningLogRepository.findByDisposition(disposition.toUpperCase());
+    }
+
+    @Override
+    @Transactional
+    public SanctionsScreeningLog recordDisposition(final Long logId, final String disposition, final String reason) {
+        final SanctionsScreeningLog log = findAlertOrThrow(logId);
+
+        final String normalised = disposition == null ? "" : disposition.trim().toUpperCase();
+        if (!SanctionsScreeningLog.DISPOSITION_FALSE_POSITIVE.equals(normalised)
+                && !SanctionsScreeningLog.DISPOSITION_CONFIRMED.equals(normalised)) {
+            throw new GeneralPlatformDomainRuleException("error.msg.sanctions.disposition.invalid",
+                    "Disposition must be FALSE_POSITIVE or CONFIRMED_MATCH.");
+        }
+        // The written reason IS the compliance record — an unexplained "not the same person" is
+        // exactly what a regulator would treat as no review having happened at all.
+        if (reason == null || reason.trim().length() < 10) {
+            throw new GeneralPlatformDomainRuleException("error.msg.sanctions.disposition.reason.required",
+                    "Record which identifiers were compared and why (minimum 10 characters).");
+        }
+
+        log.recordDisposition(normalised, reason.trim(), currentUserId());
+        screeningLogRepository.saveAndFlush(log);
+        LOG.warn("Sanctions alert {} for '{}' dispositioned as {}", logId, log.getScreenedName(), normalised);
+        return log;
+    }
+
+    @Override
+    @Transactional
+    public SanctionsScreeningLog approveDisposition(final Long logId) {
+        final SanctionsScreeningLog log = findAlertOrThrow(logId);
+
+        if (SanctionsScreeningLog.DISPOSITION_PENDING.equals(log.getDisposition())) {
+            throw new GeneralPlatformDomainRuleException("error.msg.sanctions.alert.not.reviewed",
+                    "This alert has not been reviewed yet — record a disposition before approving.");
+        }
+        final Long approverId = currentUserId();
+        // Maker-checker: whoever assessed the hit cannot also sign it off.
+        if (approverId != null && approverId.equals(log.getReviewedBy())) {
+            // Naming the reviewer turns a dead end into an instruction: the officer can see at a
+            // glance that they are the maker and that somebody else has to sign it off.
+            final String reviewer = resolveUsername(log.getReviewedBy());
+            throw new GeneralPlatformDomainRuleException("error.msg.sanctions.alert.self.approval",
+                    "This alert was assessed by '" + reviewer + "'. A different officer with the "
+                            + "APPROVE_SANCTIONS permission must approve it.",
+                    reviewer);
+        }
+
+        log.approve(approverId);
+
+        // Approving a confirmed match is the moment the freeze becomes due. Onboarding matches
+        // have no clientId and therefore nothing to freeze — that case is blocked at creation.
+        if (log.isConfirmedMatch() && log.getClientId() != null) {
+            final String frozen = sanctionsFreezeService.freezeClientAccounts(log.getClientId(), log.getId());
+            log.recordFreeze(frozen);
+            LOG.warn("Sanctions alert {}: froze accounts [{}] for client {}", logId, frozen, log.getClientId());
+        }
+        // A confirmed match is reportable under PMLA, so approval opens the STR obligation and the
+        // case becomes visible on the FIU-IND screen. Kept on this row rather than pushed into the
+        // AML alert pipeline — that pipeline is transaction-driven and this is identity-driven.
+        if (log.isConfirmedMatch()) {
+            log.raiseStr();
+        }
+        // A cleared false positive releases any freeze the alert previously imposed.
+        if (log.isApprovedFalsePositive() && log.getFrozenAccountIds() != null && !log.getFrozenAccountIds().isBlank()) {
+            sanctionsFreezeService.unfreezeClientAccounts(log.getClientId());
+            log.recordFreeze("");
+        }
+
+        screeningLogRepository.saveAndFlush(log);
+        return log;
+    }
+
+    @Override
+    @Transactional
+    public SanctionsScreeningLog recordReporting(final Long logId, final String strReference,
+            final String nodalOfficerInformedOn) {
+        final SanctionsScreeningLog log = findAlertOrThrow(logId);
+        if (!log.isConfirmedMatch()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.sanctions.reporting.not.confirmed",
+                    "Only a confirmed match is reported to FIU-IND and the nodal officer.");
+        }
+        log.recordReporting(strReference, parseDateTime(nodalOfficerInformedOn));
+        screeningLogRepository.saveAndFlush(log);
+        return log;
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public boolean hasApprovedFalsePositive(final String name) {
+        if (name == null || name.isBlank()) {
+            return false;
+        }
+        return screeningLogRepository.countApprovedFalsePositives(name.trim()) > 0;
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public boolean isNameSanctioned(final String name) {
+        if (name == null || name.isBlank()) {
+            return false;
+        }
+        return !sanctionsEntryRepository.searchByNameOrAlias(name.trim()).isEmpty();
+    }
+
+    @Override
+    @Transactional
+    public int rescreenExistingClients() {
+        // display_name is denormalised from the name parts and can drift out of sync with them —
+        // a direct DB edit, or any write path that misses it, leaves it stale. Screening the
+        // stale value would silently clear a client whose actual name is on the list, so the
+        // name parts are rebuilt here and display_name used only as the fallback.
+        final List<Map<String, Object>> clients = jdbcTemplate.queryForList(
+                "SELECT id, firstname, middlename, lastname, fullname, display_name FROM m_client "
+                        + "WHERE status_enum = 300");
+
+        int flagged = 0;
+        for (final Map<String, Object> row : clients) {
+            final Long clientId = ((Number) row.get("id")).longValue();
+            final String name = resolveScreenableName(row);
+            if (name == null || name.isBlank()) {
+                continue;
+            }
+            // Re-running the sweep must not stack another identical alert onto the queue. An open
+            // alert for this client is the same case still awaiting the same decision; repeating
+            // it buries the real work under copies of itself.
+            if (hasOpenAlert(clientId)) {
+                continue;
+            }
+            try {
+                final SanctionsScreeningResult result = screenName(name, "PERIODIC_RESCREEN", clientId, null);
+                if (result.isMatchFound()) {
+                    flagged++;
+                }
+            } catch (Exception e) {
+                LOG.error("Re-screening failed for client {} ('{}'): {}", clientId, name, e.getMessage());
+            }
+        }
+        LOG.info("Periodic re-screening complete: {} of {} clients flagged", flagged, clients.size());
+        return flagged;
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public Map<Long, String[]> resolveClientNames(final Collection<Long> clientIds) {
+        final Map<Long, String[]> byId = new HashMap<>();
+        if (clientIds == null || clientIds.isEmpty()) {
+            return byId;
+        }
+        final String placeholders = clientIds.stream().map(id -> "?").collect(Collectors.joining(","));
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
+                "SELECT id, display_name, account_no FROM m_client WHERE id IN (" + placeholders + ")",
+                clientIds.toArray());
+
+        for (final Map<String, Object> row : rows) {
+            final Long id = ((Number) row.get("id")).longValue();
+            byId.put(id, new String[] { (String) row.get("display_name"), (String) row.get("account_no") });
+        }
+        return byId;
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public String getLatestAlertStatus(final Long clientId) {
+        if (clientId == null) {
+            return null;
+        }
+        // findFlaggedByClientId already orders newest first.
+        return screeningLogRepository.findFlaggedByClientId(clientId).stream().map(SanctionsScreeningLog::getDisposition)
+                .filter(java.util.Objects::nonNull).findFirst().orElse(null);
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public List<SanctionsScreeningLog> getStrCases(final String status) {
+        final String normalised = status == null || status.isBlank() ? null : status.trim().toUpperCase();
+        return screeningLogRepository.findStrCases(normalised);
+    }
+
+    /** Username for a user id, falling back to the id when it cannot be resolved. */
+    private String resolveUsername(final Long userId) {
+        if (userId == null) {
+            return "unknown";
+        }
+        try {
+            final List<Map<String, Object>> rows = jdbcTemplate
+                    .queryForList("SELECT username FROM m_appuser WHERE id = ?", userId);
+            return rows.isEmpty() ? ("user " + userId) : (String) rows.get(0).get("username");
+        } catch (Exception e) {
+            return "user " + userId;
+        }
+    }
+
+    /** True when the client already has a flagged alert nobody has dispositioned yet. */
+    private boolean hasOpenAlert(final Long clientId) {
+        return screeningLogRepository.findFlaggedByClientId(clientId).stream().anyMatch(log -> {
+            // Unassessed — still the same case awaiting the same decision.
+            if (SanctionsScreeningLog.DISPOSITION_PENDING.equals(log.getDisposition())) {
+                return true;
+            }
+            // Assessed but not yet signed off, or a standing confirmed match. Checking only for
+            // PENDING_REVIEW left a hole: the moment an officer recorded an assessment the guard
+            // stopped seeing the alert, so every later sweep raised a fresh duplicate of a case
+            // that was already being worked — or already confirmed and frozen.
+            if (log.getApprovedBy() == null) {
+                return true;
+            }
+            return log.isConfirmedMatch();
+        });
+    }
+
+    /**
+     * The name to screen for a client row, built from the authoritative name columns.
+     *
+     * <p>
+     * An entity carries {@code fullname}; a person carries first/middle/last. Both are the source
+     * of truth, whereas {@code display_name} is a derived copy that can lag behind them. Falling
+     * back to it only when no name part exists keeps legacy rows screenable without trusting a
+     * value that may be stale.
+     * </p>
+     */
+    private String resolveScreenableName(final Map<String, Object> row) {
+        final String fullname = trimToNull((String) row.get("fullname"));
+        if (fullname != null) {
+            return fullname;
+        }
+        final String joined = Stream.of("firstname", "middlename", "lastname").map(col -> trimToNull((String) row.get(col)))
+                .filter(part -> part != null).collect(Collectors.joining(" "));
+        if (!joined.isBlank()) {
+            return joined;
+        }
+        return trimToNull((String) row.get("display_name"));
+    }
+
+    private String trimToNull(final String value) {
+        if (value == null) {
+            return null;
+        }
+        final String trimmed = value.trim();
+        return trimmed.isEmpty() ? null : trimmed;
+    }
+
+    private SanctionsScreeningLog findAlertOrThrow(final Long logId) {
+        final SanctionsScreeningLog log = screeningLogRepository.findById(logId)
+                .orElseThrow(() -> new GeneralPlatformDomainRuleException("error.msg.sanctions.alert.not.found",
+                        "Sanctions alert " + logId + " does not exist."));
+        if (!log.isFlagged()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.sanctions.alert.not.flagged",
+                    "Screening " + logId + " produced no match, so there is nothing to disposition.");
+        }
+        return log;
+    }
+
+    private Long currentUserId() {
+        try {
+            return context.authenticatedUser().getId();
+        } catch (Exception e) {
+            // Re-screening runs from a scheduler with no authenticated user.
+            return null;
+        }
+    }
+
+    private OffsetDateTime parseDateTime(final String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return LocalDate.parse(value.trim()).atStartOfDay().atOffset(ZoneOffset.UTC);
+        } catch (DateTimeParseException e) {
+            LOG.debug("Could not parse nodal officer date: {}", value);
+            return null;
+        }
+    }
+
     private Long saveLog(final String screenedName, final String result, final int matchCount,
             final String matchedEntryIds, final String matchedNames, final String source,
             final Long clientId, final String ipAddress) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/api/CurrentAccountsApiResource.java

@@ -18,6 +18,11 @@
  */
 package org.apache.fineract.portfolio.savings.api;
 
+import static org.apache.fineract.infrastructure.documentmanagement.api.DocumentApiConstants.DOCUMENT_API_PARAM_DESCRIPTION;
+import static org.apache.fineract.infrastructure.documentmanagement.api.DocumentApiConstants.DOCUMENT_API_PARAM_FILE;
+import static org.apache.fineract.infrastructure.documentmanagement.api.DocumentApiConstants.DOCUMENT_API_PARAM_NAME;
+import static org.springframework.http.HttpHeaders.CONTENT_LENGTH;
+
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
@@ -26,6 +31,7 @@ import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.DefaultValue;
 import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.PUT;
 import jakarta.ws.rs.Path;
@@ -34,9 +40,11 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.Context;
 import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import jakarta.ws.rs.core.UriInfo;
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
+import java.io.InputStream;
 import java.time.LocalDate;
 import java.util.Collection;
 import java.util.List;
@@ -50,6 +58,10 @@ import org.apache.fineract.infrastructure.core.exception.UnrecognizedQueryParamE
 import org.apache.fineract.infrastructure.core.serialization.ApiRequestJsonSerializationSettings;
 import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
 import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.documentmanagement.api.DocumentApiResource;
+import org.apache.fineract.infrastructure.documentmanagement.data.DocumentCreateResponse;
+import org.apache.fineract.infrastructure.documentmanagement.data.DocumentData;
+import org.apache.fineract.infrastructure.documentmanagement.data.DocumentDeleteResponse;
 import org.apache.fineract.infrastructure.security.exception.NoAuthorizationException;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.infrastructure.security.service.SqlValidator;
@@ -63,6 +75,9 @@ import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformS
 import org.apache.fineract.portfolio.currentaccount.service.CurrentAccountEditWritePlatformService;
 import org.apache.fineract.portfolio.currentaccount.service.CurrentAccountWritePlatformService;
 import org.apache.fineract.portfolio.savings.service.CurrentAccountTemplateReadPlatformService;
+import org.glassfish.jersey.media.multipart.FormDataBodyPart;
+import org.glassfish.jersey.media.multipart.FormDataContentDisposition;
+import org.glassfish.jersey.media.multipart.FormDataParam;
 import org.springframework.stereotype.Component;
 
 @Path("/v1/currentaccounts")
@@ -84,6 +99,10 @@ public class CurrentAccountsApiResource {
     private final CurrentAccountEditWritePlatformService currentAccountEditWritePlatformService;
     private final FromJsonHelper fromApiJsonHelper;
     private final DefaultToApiJsonSerializer<CurrentAccountPendingEditData> pendingEditApiJsonSerializer;
+    private final DocumentApiResource documentApiResource;
+
+    /** Matches the {@code entityType} current-account document requests are stored/looked up under. */
+    private static final String DOCUMENT_ENTITY_TYPE = "currentaccounts";
 
     @GET
     @Path("template")
@@ -337,4 +356,54 @@ public class CurrentAccountsApiResource {
         return this.toApiJsonSerializer.serialize(result);
     }
 
+    // ── Documents ────────────────────────────────────────────────────────────
+    // The generic /v1/{entityType}/{entityId}/documents resource (DocumentApiResource) never gets a
+    // chance to handle current-account requests: this class's own literal /v1/currentaccounts path
+    // is matched first for anything under {accountId}, and it has no "documents" method, so the
+    // request dead-ends in a 404 instead of falling through. These delegate straight to the same
+    // DocumentApiResource so current accounts get identical document-management behaviour.
+
+    @GET
+    @Path("{accountId}/documents")
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List documents attached to a current account")
+    @ApiResponse(responseCode = "200", description = "OK")
+    public List<DocumentData> retrieveDocuments(@PathParam("accountId") final Long accountId) {
+        return documentApiResource.retrieveAllDocuments(DOCUMENT_ENTITY_TYPE, accountId);
+    }
+
+    @GET
+    @Path("{accountId}/documents/{documentId}/attachment")
+    @Produces({ MediaType.APPLICATION_OCTET_STREAM })
+    @Operation(summary = "Download a document attached to a current account")
+    @ApiResponse(responseCode = "200", description = "Not Shown: The corresponding Binary file")
+    public Response downloadDocument(@PathParam("accountId") final Long accountId, @PathParam("documentId") final Long documentId) {
+        return documentApiResource.downloadFile(DOCUMENT_ENTITY_TYPE, accountId, documentId);
+    }
+
+    @POST
+    @Path("{accountId}/documents")
+    @Consumes({ MediaType.MULTIPART_FORM_DATA })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Attach a document to a current account")
+    @ApiResponse(responseCode = "200", description = "Not Shown (multi-part form data)")
+    public DocumentCreateResponse createDocument(@PathParam("accountId") final Long accountId,
+            @HeaderParam(CONTENT_LENGTH) final Long fileSize, @FormDataParam(DOCUMENT_API_PARAM_FILE) final InputStream inputStream,
+            @FormDataParam(DOCUMENT_API_PARAM_FILE) final FormDataContentDisposition fileDetails,
+            @FormDataParam(DOCUMENT_API_PARAM_FILE) final FormDataBodyPart filePart,
+            @FormDataParam(DOCUMENT_API_PARAM_NAME) final String name,
+            @FormDataParam(DOCUMENT_API_PARAM_DESCRIPTION) final String description) {
+        return documentApiResource.createDocument(DOCUMENT_ENTITY_TYPE, accountId, fileSize, inputStream, fileDetails, filePart, name,
+                description);
+    }
+
+    @DELETE
+    @Path("{accountId}/documents/{documentId}")
+    @Operation(summary = "Remove a document attached to a current account")
+    @ApiResponse(responseCode = "200", description = "OK")
+    public DocumentDeleteResponse deleteDocument(@PathParam("accountId") final Long accountId,
+            @PathParam("documentId") final Long documentId) {
+        return documentApiResource.deleteDocument(DOCUMENT_ENTITY_TYPE, accountId, documentId);
+    }
+
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/api/FixedDepositProductsBaseInterestRatesApiResource.java

@@ -29,6 +29,10 @@ import jakarta.ws.rs.core.MediaType;
 import java.time.LocalDate;
 import java.util.List;
 import lombok.RequiredArgsConstructor;
+import org.apache.fineract.commands.domain.CommandWrapper;
+import org.apache.fineract.commands.service.CommandWrapperBuilder;
+import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformService;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.savings.DepositsApiConstants;
 import org.apache.fineract.portfolio.savings.data.FdInterestRateEffectiveData;
@@ -42,6 +46,7 @@ public class FixedDepositProductsBaseInterestRatesApiResource {
 
     private final PlatformSecurityContext context;
     private final FdBaseInterestRateReadPlatformService fdBaseInterestRateReadPlatformService;
+    private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
     private final Gson gson = new GsonBuilder()
             .registerTypeAdapter(LocalDate.class,
                     (JsonSerializer<LocalDate>) (src, typeOfSrc, ctx) -> new JsonPrimitive(src.toString()))
@@ -77,11 +82,11 @@ public class FixedDepositProductsBaseInterestRatesApiResource {
     @Produces({ MediaType.APPLICATION_JSON })
     @Operation(summary = "Save new FD base interest rate version", description = "Creates a new FD CBS base chart version for the given fdType and deactivates the previous active version.")
     @ApiResponses({ @ApiResponse(responseCode = "200", description = "OK") })
-    public String saveInterestRates(@Parameter(hidden = true) final String apiRequestBodyAsJson) {
+    public CommandProcessingResult saveInterestRates(@Parameter(hidden = true) final String apiRequestBodyAsJson) {
-        this.context.authenticatedUser().validateHasReadPermission(DepositsApiConstants.FIXED_DEPOSIT_PRODUCT_RESOURCE_NAME);
+        final CommandWrapper commandRequest = new CommandWrapperBuilder()
-        final FdInterestRateSaveRequest request = gson.fromJson(apiRequestBodyAsJson, FdInterestRateSaveRequest.class);
+                .createCbsBaseInterestRate()
-        final Long createdById = this.context.authenticatedUser().getId();
+                .withJson(apiRequestBodyAsJson)
-        final FdInterestRateEffectiveData saved = this.fdBaseInterestRateReadPlatformService.saveInterestRates(request, createdById);
+                .build();
-        return gson.toJson(saved);
+        return this.commandsSourceWritePlatformService.logCommandSource(commandRequest);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/domain/FixedDepositAccount.java

@@ -435,7 +435,10 @@ public class FixedDepositAccount extends SavingsAccount {
 
     @Override
     public Money activateWithBalance() {
-        return Money.of(this.currency, this.accountTermAndPreClosure.depositAmount());
+        // Activation never deposits money -- funding happens strictly through a separate deposit
+        // transaction (posted by a clerk) after the account is already active, regardless of the
+        // deposit amount configured on the account's term/pre-closure details.
+        return Money.zero(this.currency);
     }
 
     public void close(final AppUser currentUser, final JsonCommand command, final Map<String, Object> actualChanges) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/domain/RecurringDepositAccount.java

@@ -552,7 +552,10 @@ public class RecurringDepositAccount extends SavingsAccount {
 
     @Override
     public Money activateWithBalance() {
-        return Money.of(this.currency, this.minRequiredOpeningBalance);
+        // Activation never deposits money -- funding happens strictly through a separate deposit
+        // transaction (posted by a clerk) after the account is already active, regardless of any
+        // minimum required opening balance the product has configured.
+        return Money.zero(this.currency);
     }
 
     protected void processAccountUponActivation(final DateTimeFormatter fmt, final boolean postReversals,

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/domain/SavingsAccountAssembler.java

@@ -19,7 +19,6 @@
 package org.apache.fineract.portfolio.savings.domain;
 
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.SAVINGS_ACCOUNT_RESOURCE_NAME;
-import static org.apache.fineract.portfolio.savings.SavingsApiConstants.accountFacilityConfigParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.accountNoParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.accountStatusParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.guardianClientIdParamName;
@@ -455,18 +454,10 @@ public class SavingsAccountAssembler {
         account.setLinkedAccountType(this.fromApiJsonHelper.extractStringNamed(linkedAccountTypeParamName, element));
         account.setLinkedAccountNo(this.fromApiJsonHelper.extractStringNamed(linkedAccountNoParamName, element));
 
-        // Account Facility Config
+        // Every digital facility starts disabled at account opening, regardless of anything the
-        if (element.getAsJsonObject().has(accountFacilityConfigParamName)) {
+        // request sends or the product defaults to -- they're switched on deliberately, one at a
-            final JsonElement configEl = element.getAsJsonObject().get(accountFacilityConfigParamName);
+        // time, later, through the account's own Edit Nominee & Features screen.
-            if (configEl != null && !configEl.isJsonNull() && configEl.isJsonObject()) {
+        account.setFacilityConfig(new SavingsAccountFacilityConfig(account));
-                SavingsAccountFacilityConfig facilityConfig = account.getFacilityConfig();
-                if (facilityConfig == null) {
-                    facilityConfig = new SavingsAccountFacilityConfig(account);
-                    account.setFacilityConfig(facilityConfig);
-                }
-                facilityConfig.updateFrom(configEl.getAsJsonObject());
-            }
-        }
 
         // Joint holders
         if (element.getAsJsonObject().has(jointHoldersParamName)) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/handler/CreateCbsBaseInterestRateCommandHandler.java

@@ -0,0 +1,42 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.savings.handler;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.commands.annotation.CommandType;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.portfolio.savings.service.FdBaseInterestRateWritePlatformService;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@CommandType(entity = "CBSBASEINTERESTRATE", action = "CREATE")
+@RequiredArgsConstructor
+public class CreateCbsBaseInterestRateCommandHandler implements NewCommandSourceHandler {
+
+    private final FdBaseInterestRateWritePlatformService writePlatformService;
+
+    @Transactional
+    @Override
+    public CommandProcessingResult processCommand(final JsonCommand command) {
+        return this.writePlatformService.saveInterestRates(command);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountTransactionWritePlatformServiceImpl.java

@@ -133,18 +133,10 @@ public class CurrentAccountTransactionWritePlatformServiceImpl implements Curren
                     "Insufficient available balance. Available: " + available + ", Requested: " + amount, accountId);
         }
 
-        // Minimum required balance validation
+        // Minimum required balance is not enforced -- a withdrawal must never be blocked for
+        // taking the account below its configured minimum, only for exceeding the available
+        // balance (checked above).
         final BigDecimal newBalance = currentBalance.subtract(amount);
-        if (account.isEnforceMinRequiredBalance() && account.getMinRequiredBalance() != null
-                && account.getMinRequiredBalance().compareTo(BigDecimal.ZERO) > 0) {
-            if (newBalance.compareTo(account.getMinRequiredBalance()) < 0) {
-                throw new GeneralPlatformDomainRuleException(
-                        "error.msg.current.account.min.required.balance.breached",
-                        "Withdrawal of " + amount + " would breach the minimum required balance of "
-                        + account.getMinRequiredBalance() + ". Balance after withdrawal would be " + newBalance,
-                        accountId);
-            }
-        }
 
         final String refNo = command.stringValueOfParameterNamed("accountNumber");
         final CurrentAccountTransaction txn = CurrentAccountTransaction.withdrawal(account, office, amount, txnDate, refNo);

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountWritePlatformServiceImpl.java

@@ -227,12 +227,10 @@ public class CurrentAccountWritePlatformServiceImpl implements CurrentAccountWri
             clientNomineeWritePlatformService.saveNomineeIfPresent(clientId, accountNo, "CB", json.get("nominee"));
         }
 
-        // Facility config — UI sends "accountFacilityConfig", internal uses "facilityConfig"
+        // Every digital facility starts disabled at account opening, regardless of anything the
-        JsonObject fcJson = json.getAsJsonObject("accountFacilityConfig");
+        // request sends or the product defaults to -- they're switched on deliberately, one at a
-        if (fcJson == null) fcJson = json.getAsJsonObject("facilityConfig");
+        // time, later, through the account's own Edit Nominee & Features screen.
-        if (fcJson != null) {
+        account.setFacilityConfig(CurrentAccountFacilityConfig.createFor(account));
-            account.setFacilityConfig(assembleFacilityConfig(account, fcJson));
-        }
 
         // Joint holders
         if (json.has("jointHolders") && json.get("jointHolders").isJsonArray()) {
@@ -294,61 +292,16 @@ public class CurrentAccountWritePlatformServiceImpl implements CurrentAccountWri
         final JsonObject json = command.parsedJson().getAsJsonObject();
         LocalDate activatedOnDate = parseDate(getString(json, "activatedOnDate"), getString(json, "dateFormat"), getString(json, "locale"));
         if (activatedOnDate == null) activatedOnDate = LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
-        // Validate minimum opening balance before activation
-        java.math.BigDecimal openingBalanceValue = java.math.BigDecimal.ZERO;
-        if (json.has("openingBalance") && !json.get("openingBalance").isJsonNull()) {
-            try { openingBalanceValue = json.get("openingBalance").getAsBigDecimal(); } catch (Exception ignored) {
-            // intentionally ignored
-        }
-        }
-        final java.math.BigDecimal minRequired = account.getMinRequiredOpeningBalance();
-        if (minRequired != null && minRequired.compareTo(java.math.BigDecimal.ZERO) > 0
-                && openingBalanceValue.compareTo(minRequired) < 0) {
-            throw new org.apache.fineract.infrastructure.core.exception.PlatformApiDataValidationException(
-                    java.util.List.of(org.apache.fineract.infrastructure.core.data.ApiParameterError.parameterError(
-                            "openingBalance",
-                            "Opening balance (" + openingBalanceValue + ") is less than minimum required opening balance (" + minRequired + ")",
-                            "validation.msg.currentaccount.openingBalance.less.than.min.required",
-                            openingBalanceValue, minRequired)));
-        }
 
         account.activate(activatedOnDate, user);
-        applyFacilityChargesOnActivation(account);
 
-        java.math.BigDecimal currentBalance = java.math.BigDecimal.ZERO;
+        // Activation posts no transaction of its own -- no opening-balance deposit, no
-        final java.util.List<org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountTransaction> depositTxns = new java.util.ArrayList<>();
+        // digital-facility charges applied or collected, regardless of what the account's facility
-        final java.util.List<ChargeGlEntry> chargeEntries = new java.util.ArrayList<>();
+        // config or product defaults say. Funding and any facility charges happen strictly
-
+        // afterwards, through separate transactions a clerk processes once the account is already
-        // Opening balance deposit transaction
+        // active.
-        if (openingBalanceValue.compareTo(java.math.BigDecimal.ZERO) > 0) {
-            try {
-                final org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountTransaction deposit =
-                    org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountTransaction
-                        .deposit(account, account.getOffice(), openingBalanceValue, activatedOnDate, "OPENING-BALANCE");
-                deposit.setRunningBalanceDerived(openingBalanceValue);
-                account.setTotalDepositsDerived(openingBalanceValue);
-                currentAccountTransactionRepository.saveAndFlush(deposit);
-                currentBalance = openingBalanceValue;
-                depositTxns.add(deposit);
-                log.info("Opening balance deposit {} created for account id={}", openingBalanceValue, accountId);
-            } catch (Exception e) {
-                log.warn("Could not process openingBalance for account id={}: {}", accountId, e.getMessage());
-            }
-        }
-
-        // Auto-deduct activation charges (chargeTimeEnum=3) from opening balance
-        final java.util.List<org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountCharge> activationCharges =
-                account.getCharges().stream()
-                        .filter(c -> c.getChargeTimeEnum() != null && c.getChargeTimeEnum() == 3 && !c.isPaid())
-                        .toList();
-        currentBalance = collectChargesAndPost(account, activationCharges, currentBalance, activatedOnDate, chargeEntries);
-
-        account.setAccountBalanceDerived(currentBalance);
         currentAccountRepository.saveAndFlush(account);
 
-        // Post GL journal entries — deposits in batch, each charge individually
-        postGlEntries(account, depositTxns, chargeEntries);
-
         return new CommandProcessingResultBuilder().withEntityId(accountId).build();
     }
 
@@ -637,78 +590,6 @@ public class CurrentAccountWritePlatformServiceImpl implements CurrentAccountWri
         }
     }
 
-    private void applyFacilityChargesOnActivation(final CurrentAccount account) {
-        // Use account-level facility config — reflects what was selected at account opening time
-        org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountFacilityConfig config =
-                account.getFacilityConfig();
-
-        log.info("[FacilityCharge] Activating account id={}, facilityConfig={}",
-                account.getId(), config != null ? "FOUND" : "NULL");
-
-        if (config == null) {
-            // Fallback: use product-level facility config
-            log.info("[FacilityCharge] No account-level config, falling back to product id={}", account.getProductId());
-            config = currentProductRepository.findById(account.getProductId())
-                    .map(p -> {
-                        final var pc = p.getFacilityConfig();
-                        if (pc == null) {
-                            log.info("[FacilityCharge] Product has no facility config either");
-                            return null;
-                        }
-                        // Map product config to account config fields inline
-                        org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountFacilityConfig ac =
-                                new org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountFacilityConfig();
-                        ac.setAtmFacility(Boolean.TRUE.equals(pc.getAtmFacility()));
-                        ac.setAtmWithdrawalFacility(Boolean.TRUE.equals(pc.getAtmWithdrawalFacility()));
-                        ac.setUpiFacility(Boolean.TRUE.equals(pc.getUpiFacility()));
-                        ac.setPosTransactionsFacility(Boolean.TRUE.equals(pc.getPosTransactionsFacility()));
-                        ac.setChequeBook(Boolean.TRUE.equals(pc.getChequeBook()));
-                        ac.setImpsFacility(Boolean.TRUE.equals(pc.getImpsFacility()));
-                        ac.setSmsAlerts(Boolean.TRUE.equals(pc.getSmsAlerts()));
-                        ac.setBbpsFacility(Boolean.TRUE.equals(pc.getBbpsFacility()));
-                        ac.setInsuranceCover(Boolean.TRUE.equals(pc.getInsuranceCover()));
-                        ac.setBepgFacility(Boolean.TRUE.equals(pc.getBepgFacility()));
-                        ac.setNeftFacility(Boolean.TRUE.equals(pc.getNeftFacility()));
-                        ac.setRtgsFacility(Boolean.TRUE.equals(pc.getRtgsFacility()));
-                        ac.setInterBankTotalCapFacility(Boolean.TRUE.equals(pc.getInterBankTotalCapFacility()));
-                        ac.setWithdrawalFacility(Boolean.TRUE.equals(pc.getWithdrawalFacility()));
-                        ac.setDepositFacilityKyc(Boolean.TRUE.equals(pc.getDepositFacilityKyc()));
-                        ac.setVirtualDebitCard(Boolean.TRUE.equals(pc.getVirtualDebitCard()));
-                        return ac;
-                    }).orElse(null);
-        }
-
-        if (config == null) {
-            log.warn("[FacilityCharge] No facility config found for account id={} — no charges applied", account.getId());
-            return;
-        }
-
-        final org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountFacilityConfig fc = config;
-        log.info("[FacilityCharge] Config found — ATM={} UPI={} NEFT={} RTGS={} CHEQUE={} SMS={} IMPs={} POS={} BBPS={} INS={} BEPG={} IBCAP={} WD={} KYC={} VCARD={} ATM_WD={}",
-                fc.isAtmFacility(), fc.isUpiFacility(), fc.isNeftFacility(), fc.isRtgsFacility(),
-                fc.isChequeBook(), fc.isSmsAlerts(), fc.isImpsFacility(), fc.isPosTransactionsFacility(),
-                fc.isBbpsFacility(), fc.isInsuranceCover(), fc.isBepgFacility(), fc.isInterBankTotalCapFacility(),
-                fc.isWithdrawalFacility(), fc.isDepositFacilityKyc(), fc.isVirtualDebitCard(), fc.isAtmWithdrawalFacility());
-        applyMapped(account, fc.isAtmFacility(),              "ATM_FACILITY");
-        applyMapped(account, fc.isAtmWithdrawalFacility(),    "ATM_WITHDRAWAL");
-        applyMapped(account, fc.isUpiFacility(),              "UPI_FACILITY");
-        applyMapped(account, fc.isPosTransactionsFacility(),  "POS_TRANSACTIONS");
-        // Cheque book: no longer charged at activation — the per-leaf issuance charge is now deducted
-        // when a cheque book is actually issued (ChequeBookIssuanceChargeService), not just for having
-        // the facility enabled.
-        applyMapped(account, fc.isImpsFacility(),             "IMPS_FACILITY");
-        applyMapped(account, fc.isSmsAlerts(),                "SMS_ALERTS");
-        applyMapped(account, fc.isBbpsFacility(),             "BBPS_FACILITY");
-        applyMapped(account, fc.isInsuranceCover(),           "INSURANCE_COVER");
-        applyMapped(account, fc.isBepgFacility(),             "BEPG_FACILITY");
-        applyMapped(account, fc.isNeftFacility(),             "NEFT_FACILITY");
-        applyMapped(account, fc.isRtgsFacility(),             "RTGS_FACILITY");
-        applyMapped(account, fc.isInterBankTotalCapFacility(),"INTER_BANK_TOTAL_CAP");
-        applyMapped(account, fc.isWithdrawalFacility(),       "WITHDRAWAL_FACILITY");
-        applyMapped(account, fc.isDepositFacilityKyc(),       "DEPOSIT_FACILITY_KYC");
-        applyMapped(account, fc.isVirtualDebitCard(),         "VIRTUAL_DEBIT_CARD");
-    }
-
     // Wrapper to carry a charge transaction together with its charge entity for GL posting
     private record ChargeGlEntry(
             org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountTransaction txn,
@@ -717,9 +598,8 @@ public class CurrentAccountWritePlatformServiceImpl implements CurrentAccountWri
     /**
      * Marks each of the given (unpaid) charges as paid, deducts its amount from {@code runningBalance}, creates a
      * {@code CurrentAccountTransaction.chargeDeduction(...)} row for it, and records a {@link ChargeGlEntry} for GL
-     * posting. Shared by {@link #activate(Long, JsonCommand)} (activation-time charges) and
+     * posting. Used by {@link #applyAndCollectFacilityCharges(Long, java.util.Set)} (edit-approval-time charges) --
-     * {@link #applyAndCollectFacilityCharges(Long, java.util.Set)} (edit-approval-time charges) so the
+     * activation itself no longer collects any charges. Returns the resulting balance.
-     * charge-collection logic isn't duplicated. Returns the resulting balance.
      */
     private java.math.BigDecimal collectChargesAndPost(final CurrentAccount account,
             final java.util.List<org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountCharge> charges,
@@ -875,24 +755,4 @@ public class CurrentAccountWritePlatformServiceImpl implements CurrentAccountWri
         }
     }
 
-    private void applyMapped(final CurrentAccount account, final boolean enabled, final String facilityType) {
-        if (!enabled) {
-            log.debug("[FacilityCharge] {} disabled — skip", facilityType);
-            return;
-        }
-        final var mappingOpt = facilityChargeMappingRepository.findByFacilityType(facilityType);
-        if (mappingOpt.isEmpty()) {
-            log.warn("[FacilityCharge] {} enabled but NO mapping found in m_facility_charge_mapping", facilityType);
-            return;
-        }
-        final org.apache.fineract.portfolio.charge.domain.Charge charge = mappingOpt.get().getCharge();
-        if (charge == null) {
-            log.warn("[FacilityCharge] {} mapping exists but charge_id is NULL", facilityType);
-            return;
-        }
-        log.info("[FacilityCharge] Applying charge '{}' (id={}) for facility {}", charge.getName(), charge.getId(), facilityType);
-        account.getCharges().add(
-            org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountCharge
-                .createFromFacility(account, charge));
-    }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java

@@ -172,8 +172,14 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
 
                 if (portfolioAccountData == null) {
                     final PaymentDetail paymentDetail = null;
-                    this.depositAccountDomainService.handleFDDeposit(account, fmt, account.getActivationDate(),
+                    final SavingsAccountTransaction depositTransaction = this.depositAccountDomainService.handleFDDeposit(account, fmt,
-                            amountForDeposit.getAmount(), paymentDetail);
+                            account.getActivationDate(), amountForDeposit.getAmount(), paymentDetail);
+                    // handleFDDeposit() already posts this transaction's own journal entries internally --
+                    // mark it as "existing" so the postJournalEntries(...) call below (which covers other
+                    // activation-time changes, e.g. an activation charge payment) does not post it again.
+                    if (depositTransaction != null && depositTransaction.getId() != null) {
+                        existingTransactionIds.add(depositTransaction.getId());
+                    }
                 } else {
                     final SavingsAccount fromSavingsAccount = null;
                     boolean isRegularTransaction = false;
@@ -202,8 +208,17 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
             }
 
             final boolean isPreMatureClosure = false;
-            account.updateMaturityDateAndAmount(mc, isPreMatureClosure, isSavingsInterestPostingAtCurrentPeriodEnd,
+            if (amountForDeposit.isGreaterThanZero()) {
-                    financialYearBeginningMonth);
+                account.updateMaturityDateAndAmount(mc, isPreMatureClosure, isSavingsInterestPostingAtCurrentPeriodEnd,
+                        financialYearBeginningMonth);
+            } else {
+                // No deposit has actually landed on the account yet -- project maturity using the
+                // configured deposit amount (the same approach used for the pre-activation preview and
+                // for reinvested FDs) instead of the account's real, still-empty transaction history,
+                // which would otherwise price in zero interest.
+                account.updateMaturityDateAndAmountBeforeAccountActivation(mc, isPreMatureClosure,
+                        isSavingsInterestPostingAtCurrentPeriodEnd, financialYearBeginningMonth);
+            }
             List<DepositAccountOnHoldTransaction> depositAccountOnHoldTransactions = null;
             if (account.getOnHoldFunds().compareTo(BigDecimal.ZERO) > 0) {
                 depositAccountOnHoldTransactions = this.depositAccountOnHoldTransactionRepository
@@ -275,8 +290,14 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
                 final PortfolioAccountData portfolioAccountData = this.accountAssociationsReadPlatformService
                         .retriveSavingsLinkedAssociation(savingsId);
                 if (portfolioAccountData == null) {
-                    this.depositAccountDomainService.handleRDDeposit(account, fmt, account.getActivationDate(),
+                    final SavingsAccountTransaction depositTransaction = this.depositAccountDomainService.handleRDDeposit(account, fmt,
-                            amountForDeposit.getAmount(), null, isRegularTransaction);
+                            account.getActivationDate(), amountForDeposit.getAmount(), null, isRegularTransaction);
+                    // handleRDDeposit() already posts this transaction's own journal entries internally --
+                    // mark it as "existing" so the postJournalEntries(...) call below (which covers other
+                    // activation-time changes) does not post it again.
+                    if (depositTransaction != null && depositTransaction.getId() != null) {
+                        existingTransactionIds.add(depositTransaction.getId());
+                    }
                 } else {
                     final boolean isExceptionForBalanceCheck = false;
                     final SavingsAccount fromSavingsAccount = null;
@@ -368,6 +389,19 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
         final SavingsAccountTransaction deposit = this.depositAccountDomainService.handleFDDeposit(account, fmt, transactionDate,
                 transactionAmount, paymentDetail);
 
+        // The account may have been activated with no funds yet (opening deposit is now a separate,
+        // later step) -- in that case its maturity amount was only ever projected off the configured
+        // deposit amount, with zero real transactions. Now that money has actually landed, recompute
+        // maturity date/amount off the account's real transaction history so it reflects reality.
+        final boolean isSavingsInterestPostingAtCurrentPeriodEnd = this.configurationDomainService
+                .isSavingsInterestPostingAtCurrentPeriodEnd();
+        final Integer financialYearBeginningMonth = this.configurationDomainService.retrieveFinancialYearBeginningMonth();
+        final MathContext mc = MathContext.DECIMAL64;
+        final boolean isPreMatureClosure = false;
+        account.updateMaturityDateAndAmount(mc, isPreMatureClosure, isSavingsInterestPostingAtCurrentPeriodEnd,
+                financialYearBeginningMonth);
+        this.savingAccountRepositoryWrapper.saveAndFlush(account);
+
         this.denominationBreakdownWriter.save(command, deposit.getId(), account.getId(), account.getAccountNumber(),
                 account.clientId(), account.getClient() != null ? account.getClient().getCifNumber() : null, transactionDate,
                 "DEPOSIT");

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FdBaseInterestRateReadPlatformServiceImpl.java

@@ -11,10 +11,16 @@
  */
 package org.apache.fineract.portfolio.savings.service;
 
+import java.math.BigDecimal;
 import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.Comparator;
 import java.util.List;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.data.ApiParameterError;
+import org.apache.fineract.infrastructure.core.data.DataValidatorBuilder;
+import org.apache.fineract.infrastructure.core.exception.PlatformApiDataValidationException;
 import org.apache.fineract.portfolio.savings.api.FdInterestRateSaveRequest;
 import org.apache.fineract.portfolio.savings.data.FdInterestRateEffectiveData;
 import org.apache.fineract.portfolio.savings.data.FdInterestRateSlabData;
@@ -51,7 +57,9 @@ public class FdBaseInterestRateReadPlatformServiceImpl implements FdBaseInterest
     @Override
     @Transactional
     public FdInterestRateEffectiveData saveInterestRates(FdInterestRateSaveRequest request, Long createdById) {
-        final String fdType = request.getFdType();
+        validateRequest(request);
+
+        final String fdType = request.getFdType().toUpperCase();
         final LocalDate today = LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
 
         final List<FdBaseInterestRateEffective> activeVersions = effectiveRepository
@@ -85,6 +93,125 @@ public class FdBaseInterestRateReadPlatformServiceImpl implements FdBaseInterest
         return toData(newVersion);
     }
 
+    private void validateRequest(final FdInterestRateSaveRequest request) {
+        final List<ApiParameterError> errors = new ArrayList<>();
+        final DataValidatorBuilder validator = new DataValidatorBuilder(errors).resource("FD_BASE_INTEREST_RATE_VERSION");
+
+        if (request == null) {
+            validator.failWithCodeNoParameterAddedToErrorCode("request.cannot.be.null");
+            throwExceptionIfValidationWarningsExist(errors);
+            return;
+        }
+
+        final String fdType = request.getFdType();
+        if (fdType == null || fdType.isBlank()) {
+            validator.parameter("fdType").failWithCode("cannot.be.blank");
+        } else if (!List.of("SINGLE", "DOUBLE", "SPECIAL").contains(fdType.toUpperCase())) {
+            validator.parameter("fdType").value(fdType).failWithCode("invalid.fd.type");
+        }
+
+        if (request.getSlabs() == null || request.getSlabs().isEmpty()) {
+            validator.parameter("slabs").failWithCode("cannot.be.blank");
+        }
+
+        if (request.getVersionLabel() != null && request.getVersionLabel().length() > 100) {
+            validator.parameter("versionLabel").value(request.getVersionLabel()).failWithCode("exceeds.max.length");
+        }
+
+        throwExceptionIfValidationWarningsExist(errors);
+        validateSlabs(request.getSlabs());
+    }
+
+    private void validateSlabs(final List<FdInterestRateSaveRequest.SlabRequest> slabs) {
+        final List<ApiParameterError> errors = new ArrayList<>();
+        final DataValidatorBuilder validator = new DataValidatorBuilder(errors).resource("FD_BASE_INTEREST_RATE_VERSION");
+
+        if (slabs == null || slabs.isEmpty()) {
+            validator.parameter("slabs").failWithCode("cannot.be.blank");
+            throwExceptionIfValidationWarningsExist(errors);
+            return;
+        }
+
+        final List<FdInterestRateSaveRequest.SlabRequest> sorted = new ArrayList<>(slabs);
+        sorted.sort(Comparator.comparing((FdInterestRateSaveRequest.SlabRequest slab) -> slab.getSrNo() == null ? Integer.MAX_VALUE : slab.getSrNo())
+                .thenComparing(slab -> slab.getFromPeriod() == null ? Integer.MAX_VALUE : slab.getFromPeriod()));
+
+        final Integer expectedPeriodType = sorted.get(0).getPeriodTypeEnum();
+        Integer expectedFrom = 1;
+
+        for (int i = 0; i < sorted.size(); i++) {
+            final FdInterestRateSaveRequest.SlabRequest slab = sorted.get(i);
+            final int srNo = slab.getSrNo() == null ? i + 1 : slab.getSrNo();
+            final String slabPrefix = "slabs[" + srNo + "].";
+
+            if (slab.getPeriodTypeEnum() == null) {
+                validator.parameter(slabPrefix + "periodTypeEnum").failWithCode("cannot.be.blank");
+            } else if (!slab.getPeriodTypeEnum().equals(expectedPeriodType)) {
+                validator.parameter(slabPrefix + "periodTypeEnum").value(slab.getPeriodTypeEnum())
+                        .failWithCode("must.be.consistent.across.all.slabs");
+            }
+
+            final Integer fromPeriod = slab.getFromPeriod();
+            if (fromPeriod == null) {
+                validator.parameter(slabPrefix + "fromPeriod").failWithCode("cannot.be.blank");
+            } else if (fromPeriod < 0) {
+                validator.parameter(slabPrefix + "fromPeriod").value(fromPeriod).failWithCode("must.be.non.negative");
+            } else if (!fromPeriod.equals(expectedFrom)) {
+                if (i == 0) {
+                    validator.parameter(slabPrefix + "fromPeriod").value(fromPeriod).failWithCode("first.slab.must.start.at.one");
+                } else if (fromPeriod < expectedFrom) {
+                    validator.parameter(slabPrefix + "fromPeriod").value(fromPeriod).failWithCode("must.not.overlap.previous.range");
+                } else {
+                    validator.parameter(slabPrefix + "fromPeriod").value(fromPeriod).failWithCode("must.be.continuous.with.previous.range");
+                }
+            }
+
+            final Integer toPeriod = slab.getToPeriod();
+            if (i < sorted.size() - 1) {
+                if (toPeriod == null) {
+                    validator.parameter(slabPrefix + "toPeriod").failWithCode("cannot.be.blank.for.intermediate.slab");
+                } else {
+                    if (toPeriod < 0) {
+                        validator.parameter(slabPrefix + "toPeriod").value(toPeriod).failWithCode("must.be.non.negative");
+                    }
+                    if (fromPeriod != null && toPeriod < fromPeriod) {
+                        validator.parameter(slabPrefix + "toPeriod").value(toPeriod).failWithCode("cannot.be.less.than.fromPeriod");
+                    }
+                    expectedFrom = toPeriod + 1;
+                }
+            } else {
+                if (toPeriod != null) {
+                    if (toPeriod < 0) {
+                        validator.parameter(slabPrefix + "toPeriod").value(toPeriod).failWithCode("must.be.non.negative");
+                    }
+                    if (fromPeriod != null && toPeriod < fromPeriod) {
+                        validator.parameter(slabPrefix + "toPeriod").value(toPeriod).failWithCode("cannot.be.less.than.fromPeriod");
+                    }
+                }
+            }
+
+            final BigDecimal annualRate = slab.getAnnualInterestRate();
+            if (annualRate == null) {
+                validator.parameter(slabPrefix + "annualInterestRate").failWithCode("cannot.be.blank");
+            } else if (annualRate.compareTo(BigDecimal.ZERO) < 0) {
+                validator.parameter(slabPrefix + "annualInterestRate").value(annualRate).failWithCode("must.be.non.negative");
+            }
+
+            final BigDecimal seniorRate = slab.getSeniorCitizenRate();
+            if (seniorRate != null && seniorRate.compareTo(BigDecimal.ZERO) < 0) {
+                validator.parameter(slabPrefix + "seniorCitizenRate").value(seniorRate).failWithCode("must.be.non.negative");
+            }
+        }
+
+        throwExceptionIfValidationWarningsExist(errors);
+    }
+
+    private void throwExceptionIfValidationWarningsExist(final List<ApiParameterError> dataValidationErrors) {
+        if (!dataValidationErrors.isEmpty()) {
+            throw new PlatformApiDataValidationException(dataValidationErrors);
+        }
+    }
+
     private FdInterestRateEffectiveData toData(FdBaseInterestRateEffective e) {
         List<FdInterestRateSlabData> slabs = slabRepository.findByEffectiveIdOrderBySrNo(e.getId()).stream()
                 .map(s -> FdInterestRateSlabData.builder()

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FdBaseInterestRateWritePlatformService.java

@@ -0,0 +1,27 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.savings.service;
+
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+
+public interface FdBaseInterestRateWritePlatformService {
+
+    CommandProcessingResult saveInterestRates(JsonCommand command);
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FdBaseInterestRateWritePlatformServiceImpl.java

@@ -0,0 +1,49 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.savings.service;
+
+import com.google.gson.Gson;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.savings.api.FdInterestRateSaveRequest;
+import org.apache.fineract.portfolio.savings.data.FdInterestRateEffectiveData;
+import org.springframework.stereotype.Service;
+
+@Service
+@RequiredArgsConstructor
+public class FdBaseInterestRateWritePlatformServiceImpl implements FdBaseInterestRateWritePlatformService {
+
+    private final PlatformSecurityContext context;
+    private final FdBaseInterestRateReadPlatformService readPlatformService;
+    private final Gson gson = new Gson();
+
+    @Override
+    public CommandProcessingResult saveInterestRates(final JsonCommand command) {
+        final FdInterestRateSaveRequest request = gson.fromJson(command.json(), FdInterestRateSaveRequest.class);
+        final Long createdById = this.context.authenticatedUser().getId();
+        final FdInterestRateEffectiveData saved = this.readPlatformService.saveInterestRates(request, createdById);
+        return new CommandProcessingResultBuilder()
+                .withCommandId(command.commandId())
+                .withEntityId(saved.getId())
+                .build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -220,10 +220,16 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements
             this.savingsAccountWritePlatformService.releaseAmount(savingsId, pendingEdit.getHoldTransactionId());
         }
 
-        // 2) Post the real charge(s) for newly-enabled facilities, today.
+        // 2) Post the real charge(s) for newly-enabled facilities, today -- and post the matching
+        // GL journal entries for those charge transactions (collectCharges() only books them
+        // against the account itself; it does not touch the general ledger).
         if (!newlyEnabledFacilityTypes.isEmpty()) {
+            final Set<Long> existingTransactionIds = new HashSet<>(account.findExistingTransactionIds());
+            final Set<Long> existingReversedTransactionIds = new HashSet<>(account.findExistingReversedTransactionIds());
             final var chargesAdded = this.facilityChargeAutoApplyService.applyChargesForFacilities(account, newlyEnabledFacilityTypes);
             this.facilityChargeAutoApplyService.collectCharges(account, chargesAdded, DateUtils.getBusinessLocalDate());
+            this.savingsAccountWritePlatformService.postJournalEntriesForSavingsAccount(account, existingTransactionIds,
+                    existingReversedTransactionIds, false);
         }
 
         // 3) Apply the facility-config toggles to the real row.

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountWritePlatformServiceJpaRepositoryImpl.java

@@ -97,7 +97,6 @@ import org.apache.fineract.portfolio.note.domain.Note;
 import org.apache.fineract.portfolio.note.domain.NoteRepository;
 import org.apache.fineract.portfolio.paymentdetail.domain.PaymentDetail;
 import org.apache.fineract.portfolio.paymentdetail.service.PaymentDetailWritePlatformService;
-import org.apache.fineract.portfolio.savings.service.FacilityChargeAutoApplyService;
 import org.apache.fineract.portfolio.savings.SavingsAccountTransactionType;
 import org.apache.fineract.portfolio.savings.SavingsApiConstants;
 import org.apache.fineract.portfolio.savings.SavingsTransactionBooleanValues;
@@ -167,7 +166,6 @@ public class SavingsAccountWritePlatformServiceJpaRepositoryImpl implements Savi
     private final GSIMRepositoy gsimRepository;
     private final SavingsAccountInterestPostingService savingsAccountInterestPostingService;
     private final ErrorHandler errorHandler;
-    private final FacilityChargeAutoApplyService facilityChargeAutoApplyService;
     private final DenominationBreakdownWriter denominationBreakdownWriter;
 
     @Transactional
@@ -203,23 +201,9 @@ public class SavingsAccountWritePlatformServiceJpaRepositoryImpl implements Savi
 
         final SavingsAccount account = this.savingAccountAssembler.assembleFrom(savingsId, false);
 
-        // Validate minimum opening balance
+        // Minimum required opening balance is not enforced -- activation must never be blocked
-        BigDecimal openingBalanceForValidation = BigDecimal.ZERO;
+        // for not meeting it; the account can be funded afterwards by whatever deposit the
-        if (command.parameterExists("openingBalance")) {
+        // customer brings (cash or a transfer), on their own timeline.
-            final BigDecimal ob = command.bigDecimalValueOfParameterNamed("openingBalance");
-            if (ob != null) openingBalanceForValidation = ob;
-        }
-        final BigDecimal minRequiredOpening = account.getMinRequiredOpeningBalance();
-        if (minRequiredOpening != null && minRequiredOpening.compareTo(BigDecimal.ZERO) > 0
-                && openingBalanceForValidation.compareTo(minRequiredOpening) < 0) {
-            final List<ApiParameterError> errors = new ArrayList<>();
-            errors.add(ApiParameterError.parameterError(
-                    "openingBalance",
-                    "Opening balance (" + openingBalanceForValidation + ") is less than minimum required opening balance (" + minRequiredOpening + ")",
-                    "validation.msg.savingsaccount.openingBalance.less.than.min.required",
-                    openingBalanceForValidation, minRequiredOpening));
-            throw new PlatformApiDataValidationException(errors);
-        }
 
         checkClientOrGroupActive(account);
         final Set<Long> existingTransactionIds = new HashSet<>();
@@ -236,14 +220,10 @@ public class SavingsAccountWritePlatformServiceJpaRepositoryImpl implements Savi
             final Locale locale = command.extractLocale();
             final DateTimeFormatter fmt = DateTimeFormatter.ofPattern(command.dateFormat()).withLocale(locale);
             processPostActiveActions(account, fmt, existingTransactionIds, existingReversedTransactionIds);
-            // Auto-apply facility charges based on product facility config
+            // Activation posts no transaction of its own -- digital-facility charges are no longer
-            facilityChargeAutoApplyService.applyFacilityChargesOnActivation(account);
+            // auto-applied and auto-collected here. Whatever facilities are turned on later get
-            this.savingAccountRepositoryWrapper.saveAndFlush(account);
+            // charged (if at all) through the normal charge/collection flow at that time, not as a
-            // Collect any newly added facility activation charges (after flush so amountOutstanding is set)
+            // side effect of activation.
-            // payCharge() internally adds transactions to account.transactions via handleChargeTransactions
-            // Do NOT add to existingTransactionIds — postJournalEntries must include them for GL posting
-            facilityChargeAutoApplyService.collectActivationCharges(account);
-            this.savingAccountRepositoryWrapper.saveAndFlush(account);
         }
 
         postJournalEntries(account, existingTransactionIds, existingReversedTransactionIds, false);
@@ -1521,6 +1501,12 @@ public class SavingsAccountWritePlatformServiceJpaRepositoryImpl implements Savi
         this.journalEntryWritePlatformService.createJournalEntriesForSavings(accountingBridgeData);
     }
 
+    @Override
+    public void postJournalEntriesForSavingsAccount(final SavingsAccount account, final Set<Long> existingTransactionIds,
+            final Set<Long> existingReversedTransactionIds, final boolean backdatedTxnsAllowedTill) {
+        postJournalEntries(account, existingTransactionIds, existingReversedTransactionIds, backdatedTxnsAllowedTill);
+    }
+
     @Override
     public CommandProcessingResult inactivateCharge(final Long savingsAccountId, final Long savingsAccountChargeId) {
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/starter/SavingsConfiguration.java

@@ -169,6 +169,8 @@ import org.apache.fineract.portfolio.savings.service.RdBaseInterestRateReadPlatf
 import org.apache.fineract.portfolio.savings.service.RdBaseInterestRateReadPlatformServiceImpl;
 import org.apache.fineract.portfolio.savings.service.FdBaseInterestRateReadPlatformService;
 import org.apache.fineract.portfolio.savings.service.FdBaseInterestRateReadPlatformServiceImpl;
+import org.apache.fineract.portfolio.savings.service.FdBaseInterestRateWritePlatformService;
+import org.apache.fineract.portfolio.savings.service.FdBaseInterestRateWritePlatformServiceImpl;
 import org.apache.fineract.portfolio.savings.service.SavingsSchedularInterestPoster;
 import org.apache.fineract.portfolio.savings.service.SavingsSchedularInterestPosterTask;
 import org.apache.fineract.portfolio.savings.service.search.SavingsAccountTransactionSearchService;
@@ -200,6 +202,14 @@ public class SavingsConfiguration {
         return new FdBaseInterestRateReadPlatformServiceImpl(effectiveRepository, slabRepository);
     }
 
+    @Bean
+    @ConditionalOnMissingBean(FdBaseInterestRateWritePlatformService.class)
+    public FdBaseInterestRateWritePlatformService fdBaseInterestRateWritePlatformService(
+            PlatformSecurityContext context,
+            FdBaseInterestRateReadPlatformService readPlatformService) {
+        return new FdBaseInterestRateWritePlatformServiceImpl(context, readPlatformService);
+    }
+
     @Bean
     @ConditionalOnMissingBean(SavingsAccountTransactionSearchService.class)
     public SavingsAccountTransactionSearchService savingsAccountTransactionSearchService(PlatformSecurityContext context,
@@ -463,8 +473,7 @@ public class SavingsConfiguration {
             EntityDatatableChecksWritePlatformService entityDatatableChecksWritePlatformService, AppUserRepositoryWrapper appuserRepository,
             StandingInstructionRepository standingInstructionRepository, BusinessEventNotifierService businessEventNotifierService,
             GSIMRepositoy gsimRepository, SavingsAccountInterestPostingService savingsAccountInterestPostingService,
-            ErrorHandler errorHandler, FacilityChargeAutoApplyService facilityChargeAutoApplyService,
+            ErrorHandler errorHandler, DenominationBreakdownWriter denominationBreakdownWriter) {
-            DenominationBreakdownWriter denominationBreakdownWriter) {
         return new SavingsAccountWritePlatformServiceJpaRepositoryImpl(context, fromApiJsonDeserializer, savingAccountRepositoryWrapper,
                 staffRepository, savingsAccountTransactionRepository, savingAccountAssembler, savingsAccountTransactionDataValidator,
                 savingsAccountChargeDataValidator, paymentDetailWritePlatformService, journalEntryWritePlatformService,
@@ -472,7 +481,7 @@ public class SavingsConfiguration {
                 chargeRepository, savingsAccountChargeRepository, holidayRepository, workingDaysRepository, configurationDomainService,
                 depositAccountOnHoldTransactionRepository, entityDatatableChecksWritePlatformService, appuserRepository,
                 standingInstructionRepository, businessEventNotifierService, gsimRepository, savingsAccountInterestPostingService,
-                errorHandler, facilityChargeAutoApplyService, denominationBreakdownWriter);
+                errorHandler, denominationBreakdownWriter);
     }
 
     @Bean

fineract-provider/src/main/java/org/apache/fineract/portfolio/welcomekit/data/ClientWelcomeKitData.java

@@ -28,6 +28,7 @@ import lombok.Data;
 public class ClientWelcomeKitData implements Serializable {
 
     private final String clientName;
+    private final boolean clientActive;
     private final boolean canDispatchNew;
     private final List<WelcomeKitDispatchData> dispatches;
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/welcomekit/data/WelcomeKitDispatchData.java

@@ -31,10 +31,13 @@ public class WelcomeKitDispatchData implements Serializable {
     private final Long clientId;
     private final String clientName;
     private final String deliveryAddress;
+    private final Long addressId;
     private final String deliveryMode;
     private final String deliveryModeOtherText;
     private final String trackingId;
     private final String status;
     private final LocalDate dispatchedOnDate;
     private final LocalDate deliveredOnDate;
+    private final LocalDate returnedOnDate;
+    private final String remarks;
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/welcomekit/domain/WelcomeKitDispatch.java

@@ -39,6 +39,13 @@ import org.springframework.data.jpa.domain.support.AuditingEntityListener;
 @EntityListeners(AuditingEntityListener.class)
 public class WelcomeKitDispatch extends AbstractPersistableCustom<Long> {
 
+    /** Kit handed over to the delivery partner; awaiting the outcome. */
+    public static final String STATUS_DISPATCHED = "DISPATCHED";
+    /** Delivery partner confirmed delivery, so the address stands verified. */
+    public static final String STATUS_DELIVERED = "DELIVERED";
+    /** Kit came back undelivered, so the address could not be verified. */
+    public static final String STATUS_RETURNED = "RETURNED";
+
     @ManyToOne
     @JoinColumn(name = "client_id", nullable = false)
     private Client client;
@@ -46,6 +53,13 @@ public class WelcomeKitDispatch extends AbstractPersistableCustom<Long> {
     @Column(name = "delivery_address", length = 500, nullable = false)
     private String deliveryAddress;
 
+    /**
+     * The client address this kit was posted to. Kept as a plain id rather than an association because the
+     * address it points at may later be edited or removed, while the dispatch record must stay as it was.
+     */
+    @Column(name = "address_id")
+    private Long addressId;
+
     @Column(name = "delivery_mode", length = 50, nullable = false)
     private String deliveryMode;
 
@@ -64,6 +78,12 @@ public class WelcomeKitDispatch extends AbstractPersistableCustom<Long> {
     @Column(name = "delivered_on_date")
     private LocalDate deliveredOnDate;
 
+    @Column(name = "returned_on_date")
+    private LocalDate returnedOnDate;
+
+    @Column(name = "remarks", length = 500)
+    private String remarks;
+
     @CreatedBy
     @Column(name = "created_by", updatable = false)
     private Long createdBy;
@@ -84,11 +104,12 @@ public class WelcomeKitDispatch extends AbstractPersistableCustom<Long> {
         // Default constructor for JPA
     }
 
-    private WelcomeKitDispatch(final Client client, final String deliveryAddress, final String deliveryMode,
+    private WelcomeKitDispatch(final Client client, final String deliveryAddress, final Long addressId, final String deliveryMode,
             final String deliveryModeOtherText, final String trackingId, final String status,
             final LocalDate dispatchedOnDate) {
         this.client = client;
         this.deliveryAddress = deliveryAddress;
+        this.addressId = addressId;
         this.deliveryMode = deliveryMode;
         this.deliveryModeOtherText = deliveryModeOtherText;
         this.trackingId = trackingId;
@@ -96,9 +117,10 @@ public class WelcomeKitDispatch extends AbstractPersistableCustom<Long> {
         this.dispatchedOnDate = dispatchedOnDate;
     }
 
-    public static WelcomeKitDispatch createNew(final Client client, final String deliveryAddress, final String deliveryMode,
+    public static WelcomeKitDispatch createNew(final Client client, final String deliveryAddress, final Long addressId,
-            final String deliveryModeOtherText, final String trackingId, final LocalDate dispatchedOnDate) {
+            final String deliveryMode, final String deliveryModeOtherText, final String trackingId, final LocalDate dispatchedOnDate) {
-        return new WelcomeKitDispatch(client, deliveryAddress, deliveryMode, deliveryModeOtherText, trackingId, "DISPATCHED", dispatchedOnDate);
+        return new WelcomeKitDispatch(client, deliveryAddress, addressId, deliveryMode, deliveryModeOtherText, trackingId,
+                STATUS_DISPATCHED, dispatchedOnDate);
     }
 
     public Client getClient() {
@@ -109,10 +131,23 @@ public class WelcomeKitDispatch extends AbstractPersistableCustom<Long> {
         return this.status;
     }
 
-    public void updateStatus(final String newStatus, final LocalDate deliveredOnDate) {
+    public String getTrackingId() {
+        return this.trackingId;
+    }
+
+    /**
+     * Records the outcome the operator read off the delivery partner's website or app. DELIVERED stamps the delivery
+     * date and clears any previous return date, RETURNED does the reverse, so the two dates can never both be set.
+     */
+    public void updateStatus(final String newStatus, final LocalDate outcomeDate, final String remarks) {
         this.status = newStatus;
-        if ("DELIVERED".equals(newStatus)) {
+        if (STATUS_DELIVERED.equals(newStatus)) {
-            this.deliveredOnDate = deliveredOnDate;
+            this.deliveredOnDate = outcomeDate;
+            this.returnedOnDate = null;
+        } else if (STATUS_RETURNED.equals(newStatus)) {
+            this.returnedOnDate = outcomeDate;
+            this.deliveredOnDate = null;
         }
+        this.remarks = remarks;
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/welcomekit/domain/WelcomeKitDispatchRepository.java

@@ -25,4 +25,6 @@ import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
 public interface WelcomeKitDispatchRepository extends JpaRepository<WelcomeKitDispatch, Long>, JpaSpecificationExecutor<WelcomeKitDispatch> {
 
     List<WelcomeKitDispatch> findByClientIdOrderByCreatedDateDesc(Long clientId);
+
+    boolean existsByTrackingIdIgnoreCase(String trackingId);
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/welcomekit/service/WelcomeKitReadPlatformServiceImpl.java

@@ -22,10 +22,13 @@ import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.time.LocalDate;
 import java.util.List;
+import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.domain.JdbcSupport;
+import org.apache.fineract.portfolio.client.domain.ClientStatus;
 import org.apache.fineract.portfolio.welcomekit.data.ClientWelcomeKitData;
 import org.apache.fineract.portfolio.welcomekit.data.WelcomeKitDispatchData;
+import org.apache.fineract.portfolio.welcomekit.domain.WelcomeKitDispatch;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.RowMapper;
 import org.springframework.stereotype.Service;
@@ -43,20 +46,21 @@ public class WelcomeKitReadPlatformServiceImpl implements WelcomeKitReadPlatform
         
         List<WelcomeKitDispatchData> dispatches = this.jdbcTemplate.query(sql, rm, clientId);
         
-        String clientName = this.jdbcTemplate.queryForObject("SELECT display_name FROM m_client WHERE id = ?", String.class, clientId);
+        final Map<String, Object> client = this.jdbcTemplate.queryForMap("SELECT display_name, status_enum FROM m_client WHERE id = ?",
-        
+                clientId);
-        boolean canDispatchNew = true;
+        final String clientName = (String) client.get("display_name");
-        if (!dispatches.isEmpty()) {
+        final boolean clientActive = ClientStatus.fromInt((Integer) client.get("status_enum")).isActive();
-            WelcomeKitDispatchData latest = dispatches.get(0);
+
-            if ("RETURNED".equals(latest.getStatus())) {
+        // A kit only goes out for an active client, and only one kit is in flight at a time: a fresh one can follow
-                canDispatchNew = true;
+        // a returned kit (the address is being retried) but never a delivered or still-in-transit one.
-            } else {
+        boolean canDispatchNew = clientActive;
-                canDispatchNew = false;
+        if (clientActive && !dispatches.isEmpty()) {
-            }
+            canDispatchNew = WelcomeKitDispatch.STATUS_RETURNED.equals(dispatches.get(0).getStatus());
         }
-        
+
         return ClientWelcomeKitData.builder()
                 .clientName(clientName)
+                .clientActive(clientActive)
                 .canDispatchNew(canDispatchNew)
                 .dispatches(dispatches)
                 .build();
@@ -66,9 +70,10 @@ public class WelcomeKitReadPlatformServiceImpl implements WelcomeKitReadPlatform
 
         public String schema() {
             return " w.id as id, w.client_id as clientId, c.display_name as clientName, "
-                 + " w.delivery_address as deliveryAddress, w.delivery_mode as deliveryMode, "
+                 + " w.delivery_address as deliveryAddress, w.address_id as addressId, w.delivery_mode as deliveryMode, "
                  + " w.delivery_mode_other_text as deliveryModeOtherText, w.tracking_id as trackingId, "
-                 + " w.status as status, w.dispatched_on_date as dispatchedOnDate, w.delivered_on_date as deliveredOnDate "
+                 + " w.status as status, w.dispatched_on_date as dispatchedOnDate, w.delivered_on_date as deliveredOnDate, "
+                 + " w.returned_on_date as returnedOnDate, w.remarks as remarks "
                  + " FROM m_welcome_kit_dispatch w "
                  + " JOIN m_client c ON c.id = w.client_id ";
         }
@@ -79,24 +84,31 @@ public class WelcomeKitReadPlatformServiceImpl implements WelcomeKitReadPlatform
             final Long clientId = rs.getLong("clientId");
             final String clientName = rs.getString("clientName");
             final String deliveryAddress = rs.getString("deliveryAddress");
+            // Nullable: kits dispatched before the address link existed carry no address id.
+            final Long addressId = JdbcSupport.getLong(rs, "addressId");
             final String deliveryMode = rs.getString("deliveryMode");
             final String deliveryModeOtherText = rs.getString("deliveryModeOtherText");
             final String trackingId = rs.getString("trackingId");
             final String status = rs.getString("status");
             final LocalDate dispatchedOnDate = JdbcSupport.getLocalDate(rs, "dispatchedOnDate");
             final LocalDate deliveredOnDate = JdbcSupport.getLocalDate(rs, "deliveredOnDate");
+            final LocalDate returnedOnDate = JdbcSupport.getLocalDate(rs, "returnedOnDate");
+            final String remarks = rs.getString("remarks");
 
             return WelcomeKitDispatchData.builder()
                     .id(id)
                     .clientId(clientId)
                     .clientName(clientName)
                     .deliveryAddress(deliveryAddress)
+                    .addressId(addressId)
                     .deliveryMode(deliveryMode)
                     .deliveryModeOtherText(deliveryModeOtherText)
                     .trackingId(trackingId)
                     .status(status)
                     .dispatchedOnDate(dispatchedOnDate)
                     .deliveredOnDate(deliveredOnDate)
+                    .returnedOnDate(returnedOnDate)
+                    .remarks(remarks)
                     .build();
         }
     }

fineract-provider/src/main/java/org/apache/fineract/portfolio/welcomekit/service/WelcomeKitWritePlatformServiceImpl.java

@@ -19,12 +19,12 @@
 package org.apache.fineract.portfolio.welcomekit.service;
 
 import java.time.LocalDate;
-import java.util.UUID;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.api.JsonCommand;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.client.domain.Client;
 import org.apache.fineract.portfolio.client.domain.ClientRepositoryWrapper;
@@ -48,9 +48,16 @@ public class WelcomeKitWritePlatformServiceImpl implements WelcomeKitWritePlatfo
 
         final Client client = this.clientRepository.findOneWithNotFoundDetection(clientId);
 
+        if (!client.isActive()) {
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.client.must.be.active",
+                    "A welcome kit can only be dispatched for an active client.");
+        }
+
         final String deliveryAddress = command.stringValueOfParameterNamed("deliveryAddress");
         final String deliveryMode = command.stringValueOfParameterNamed("deliveryMode");
         final String deliveryModeOtherText = command.stringValueOfParameterNamed("deliveryModeOtherText");
+        final String trackingId = command.stringValueOfParameterNamed("trackingId");
+        final Long addressId = command.longValueOfParameterNamed("addressId");
         final LocalDate dispatchedOnDate = command.localDateValueOfParameterNamed("dispatchedOnDate");
 
         if (deliveryAddress == null || deliveryAddress.trim().isEmpty()) {
@@ -61,15 +68,29 @@ public class WelcomeKitWritePlatformServiceImpl implements WelcomeKitWritePlatfo
             throw new PlatformDataIntegrityException("error.msg.welcomekit.deliveryMode.cannot.be.blank",
                     "Delivery mode cannot be blank.");
         }
+        if (trackingId == null || trackingId.trim().isEmpty()) {
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.trackingId.cannot.be.blank",
+                    "Tracking ID cannot be blank.");
+        }
         if (dispatchedOnDate == null) {
             throw new PlatformDataIntegrityException("error.msg.welcomekit.dispatchedOnDate.cannot.be.blank",
                     "Dispatched on date cannot be blank.");
         }
+        if (dispatchedOnDate.isAfter(DateUtils.getBusinessLocalDate())) {
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.dispatchedOnDate.in.the.future",
+                    "Dispatched on date cannot be in the future.");
+        }
 
-        final String trackingId = "WK-" + UUID.randomUUID().toString().substring(0, 8).toUpperCase();
+        // The tracking ID is transcribed by hand from the delivery partner's receipt, so a typo could otherwise
+        // silently attach one client's consignment number to another client's kit.
+        final String sanitisedTrackingId = trackingId.trim();
+        if (this.welcomeKitDispatchRepository.existsByTrackingIdIgnoreCase(sanitisedTrackingId)) {
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.trackingId.duplicate",
+                    "Tracking ID " + sanitisedTrackingId + " is already recorded against another welcome kit dispatch.");
+        }
 
-        final WelcomeKitDispatch newDispatch = WelcomeKitDispatch.createNew(client, deliveryAddress, deliveryMode, deliveryModeOtherText,
+        final WelcomeKitDispatch newDispatch = WelcomeKitDispatch.createNew(client, deliveryAddress, addressId, deliveryMode,
-                trackingId, dispatchedOnDate);
+                deliveryModeOtherText, sanitisedTrackingId, dispatchedOnDate);
 
         this.welcomeKitDispatchRepository.saveAndFlush(newDispatch);
 
@@ -94,12 +115,30 @@ public class WelcomeKitWritePlatformServiceImpl implements WelcomeKitWritePlatfo
             throw new PlatformDataIntegrityException("error.msg.welcomekit.status.cannot.be.blank", "Status cannot be blank.");
         }
 
-        LocalDate deliveredOnDate = null;
+        final String newStatus = status.trim().toUpperCase();
-        if ("DELIVERED".equals(status)) {
+        if (!WelcomeKitDispatch.STATUS_DELIVERED.equals(newStatus) && !WelcomeKitDispatch.STATUS_RETURNED.equals(newStatus)) {
-            deliveredOnDate = LocalDate.now();
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.status.invalid",
+                    "Status must be either " + WelcomeKitDispatch.STATUS_DELIVERED + " or " + WelcomeKitDispatch.STATUS_RETURNED + ".");
         }
 
-        dispatch.updateStatus(status, deliveredOnDate);
+        // The outcome is recorded once. A kit that already came back is replaced by a fresh dispatch rather than
+        // being flipped to delivered after the fact.
+        if (!WelcomeKitDispatch.STATUS_DISPATCHED.equals(dispatch.getStatus())) {
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.outcome.already.recorded",
+                    "This welcome kit is already marked as " + dispatch.getStatus() + ".");
+        }
+
+        // The outcome date is optional; the operator may only know the day they checked the courier's site.
+        LocalDate outcomeDate = command.localDateValueOfParameterNamed("outcomeDate");
+        if (outcomeDate == null) {
+            outcomeDate = DateUtils.getBusinessLocalDate();
+        }
+        if (outcomeDate.isAfter(DateUtils.getBusinessLocalDate())) {
+            throw new PlatformDataIntegrityException("error.msg.welcomekit.outcomeDate.in.the.future",
+                    "Outcome date cannot be in the future.");
+        }
+
+        dispatch.updateStatus(newStatus, outcomeDate, command.stringValueOfParameterNamed("remarks"));
 
         this.welcomeKitDispatchRepository.saveAndFlush(dispatch);
 

fineract-provider/src/main/java/org/apache/fineract/useradministration/api/AppUserPreferencesApiResource.java

@@ -0,0 +1,79 @@
+package org.apache.fineract.useradministration.api;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.Parameter;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.security.exception.NoAuthorizationException;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.useradministration.data.AppUserPreferenceData;
+import org.apache.fineract.useradministration.service.AppUserPreferenceReadPlatformService;
+import org.apache.fineract.useradministration.service.AppUserPreferenceWritePlatformService;
+import org.springframework.stereotype.Component;
+
+@Path("/v1/users/{userId}/preferences")
+@Component
+@Tag(name = "User Preferences", description = "API to manage user specific preferences.")
+@RequiredArgsConstructor
+public class AppUserPreferencesApiResource {
+
+    private final PlatformSecurityContext context;
+    private final AppUserPreferenceReadPlatformService readPlatformService;
+    private final AppUserPreferenceWritePlatformService writePlatformService;
+
+    private void validateUserAuthorization(Long userId) {
+        if (!context.authenticatedUser().getId().equals(userId)) {
+            throw new NoAuthorizationException("Not authorized to access or modify preferences for another user.");
+        }
+    }
+
+    @GET
+    @Path("{preferenceName}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Retrieve user preference", description = "Retrieves a specific preference for the user.")
+    @ApiResponses({
+            @ApiResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = AppUserPreferenceData.class))) })
+    public AppUserPreferenceData getPreference(@PathParam("userId") @Parameter(description = "userId") final Long userId,
+            @PathParam("preferenceName") @Parameter(description = "preferenceName") final String preferenceName) {
+
+        validateUserAuthorization(userId);
+        String value = readPlatformService.getPreferenceValue(userId, preferenceName);
+        return new AppUserPreferenceData(preferenceName, value);
+    }
+
+    @PUT
+    @Path("{preferenceName}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Update user preference", description = "Updates or creates a specific preference for the user.")
+    @RequestBody(required = true, content = @Content(schema = @Schema(implementation = AppUserPreferenceData.class)))
+    @ApiResponses({ @ApiResponse(responseCode = "200", description = "OK") })
+    public AppUserPreferenceData updatePreference(@PathParam("userId") @Parameter(description = "userId") final Long userId,
+            @PathParam("preferenceName") @Parameter(description = "preferenceName") final String preferenceName,
+            final AppUserPreferenceData preferenceData) {
+
+        validateUserAuthorization(userId);
+
+        // Ensure the path parameter matches the request body if the request body contains a name
+        String valueToSave = preferenceData != null ? preferenceData.getValue() : null;
+        if (valueToSave == null) {
+            throw new IllegalArgumentException("Preference value cannot be null");
+        }
+
+        writePlatformService.updatePreference(userId, preferenceName, valueToSave);
+        return new AppUserPreferenceData(preferenceName, valueToSave);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/api/UsersApiResource.java

@@ -88,6 +88,11 @@ public class UsersApiResource {
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
     private final BulkImportWorkbookPopulatorService bulkImportWorkbookPopulatorService;
     private final BulkImportWorkbookService bulkImportWorkbookService;
+    private final org.apache.fineract.useradministration.service.UserPendingWritePlatformService userPendingWritePlatformService;
+    private final org.apache.fineract.useradministration.service.UserPendingReadPlatformService userPendingReadPlatformService;
+    private final org.apache.fineract.infrastructure.core.serialization.FromJsonHelper fromApiJsonHelper;
+    private final org.apache.fineract.infrastructure.configuration.domain.ConfigurationDomainService configurationDomainService;
+    private final DefaultToApiJsonSerializer<org.apache.fineract.useradministration.data.UserPendingRequestData> pendingRequestApiJsonSerializer;
 
     @GET
     @Operation(summary = "Retrieve list of users", description = "Example Requests:\n" + "\n" + "users\n" + "\n" + "\n"
@@ -158,6 +163,12 @@ public class UsersApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     public String create(@Parameter(hidden = true) final String apiRequestBodyAsJson) {
+        if (this.configurationDomainService.isMakerCheckerEnabled()) {
+            final org.apache.fineract.infrastructure.core.api.JsonCommand command = org.apache.fineract.infrastructure.core.api.JsonCommand
+                    .fromJsonElement(null, this.fromApiJsonHelper.parse(apiRequestBodyAsJson), this.fromApiJsonHelper);
+            final CommandProcessingResult result = this.userPendingWritePlatformService.submitCreateUser(command);
+            return this.toApiJsonSerializer.serialize(result);
+        }
 
         final CommandWrapper commandRequest = new CommandWrapperBuilder() //
                 .createUser() //
@@ -179,6 +190,12 @@ public class UsersApiResource {
     @Produces({ MediaType.APPLICATION_JSON })
     public String update(@PathParam("userId") @Parameter(description = "userId") final Long userId,
             @Parameter(hidden = true) final String apiRequestBodyAsJson) {
+        if (this.configurationDomainService.isMakerCheckerEnabled()) {
+            final org.apache.fineract.infrastructure.core.api.JsonCommand command = org.apache.fineract.infrastructure.core.api.JsonCommand
+                    .fromJsonElement(userId, this.fromApiJsonHelper.parse(apiRequestBodyAsJson), this.fromApiJsonHelper);
+            final CommandProcessingResult result = this.userPendingWritePlatformService.submitUpdateUser(userId, command);
+            return this.toApiJsonSerializer.serialize(result);
+        }
 
         final CommandWrapper commandRequest = new CommandWrapperBuilder() //
                 .updateUser(userId) //
@@ -190,6 +207,56 @@ public class UsersApiResource {
         return this.toApiJsonSerializer.serialize(result);
     }
 
+    @GET
+    @Path("pending")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List User creations & edits pending approval")
+    public org.apache.fineract.infrastructure.core.service.Page<org.apache.fineract.useradministration.data.UserPendingRequestData> retrieveAllPendingUsers(
+            @QueryParam("status") final String status,
+            @QueryParam("username") final String username,
+            @QueryParam("fromDate") final String fromDate,
+            @QueryParam("toDate") final String toDate,
+            @QueryParam("offset") final Integer offset,
+            @QueryParam("limit") final Integer limit) {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSIONS);
+        return this.userPendingReadPlatformService.retrieveAllPendingRequests(status, username, fromDate, toDate, offset, limit);
+    }
+
+    @GET
+    @Path("pending/{id}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Retrieve a pending user request by ID")
+    public String retrievePendingUser(@PathParam("id") final Long id, @Context final UriInfo uriInfo) {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSIONS);
+        final org.apache.fineract.useradministration.data.UserPendingRequestData data = this.userPendingReadPlatformService.retrievePendingRequest(id);
+        final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
+        return this.pendingRequestApiJsonSerializer.serialize(settings, data);
+    }
+
+    @POST
+    @Path("pending/{id}/approve")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Approve a pending User creation or update")
+    public String approvePendingUser(@PathParam("id") final Long id) {
+        final CommandProcessingResult result = this.userPendingWritePlatformService.approvePendingRequest(id);
+        return this.toApiJsonSerializer.serialize(result);
+    }
+
+    @POST
+    @Path("pending/{id}/reject")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Reject a pending User creation or update")
+    public String rejectPendingUser(@PathParam("id") final Long id, @Parameter(hidden = true) final String apiRequestBodyAsJson) {
+        final org.apache.fineract.infrastructure.core.api.JsonCommand command = org.apache.fineract.infrastructure.core.api.JsonCommand
+                .fromJsonElement(id, this.fromApiJsonHelper.parse(apiRequestBodyAsJson), this.fromApiJsonHelper);
+        final CommandProcessingResult result = this.userPendingWritePlatformService.rejectPendingRequest(id, command);
+        return this.toApiJsonSerializer.serialize(result);
+    }
+
     @POST
     @Path("{userId}/pwd")
     @Operation(summary = "Change the password of a User", description = "When updating a password you must provide the repeatPassword parameter also.")

fineract-provider/src/main/java/org/apache/fineract/useradministration/data/AppUserPreferenceData.java

@@ -0,0 +1,13 @@
+package org.apache.fineract.useradministration.data;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import lombok.AllArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class AppUserPreferenceData {
+    private String name;
+    private String value;
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/data/UserPendingRequestData.java

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.data;
+
+import java.io.Serializable;
+import java.time.OffsetDateTime;
+import java.util.Collection;
+import java.util.Map;
+import lombok.Builder;
+import lombok.Getter;
+
+@Getter
+@Builder
+public class UserPendingRequestData implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    private final Long id;
+    private final Long userId;
+    private final String requestType;
+    private final String status;
+    private final String username;
+    private final String firstname;
+    private final String lastname;
+    private final String email;
+    private final String mobileNo;
+    private final Long officeId;
+    private final String officeName;
+    private final Long staffId;
+    private final String staffName;
+    private final String otpDeliveryMethod;
+    private final Boolean passwordNeverExpires;
+    private final Collection<String> roleNames;
+    private final Long makerId;
+    private final String makerUsername;
+    private final OffsetDateTime submittedDate;
+    private final Long checkerId;
+    private final String checkerUsername;
+    private final OffsetDateTime checkedDate;
+    private final String rejectReason;
+    private final Map<String, Object> originalValues;
+    private final Map<String, Object> proposedValues;
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/AppUserPreference.java

@@ -0,0 +1,54 @@
+package org.apache.fineract.useradministration.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.FetchType;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+
+@Entity
+@Table(name = "m_appuser_preference")
+public class AppUserPreference extends AbstractPersistableCustom<Long> {
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "appuser_id", nullable = false)
+    private AppUser appUser;
+
+    @Column(name = "name", length = 100, nullable = false)
+    private String name;
+
+    @Column(name = "value", nullable = false)
+    private String value;
+
+    protected AppUserPreference() {
+        //
+    }
+
+    private AppUserPreference(final AppUser appUser, final String name, final String value) {
+        this.appUser = appUser;
+        this.name = name;
+        this.value = value;
+    }
+
+    public static AppUserPreference create(final AppUser appUser, final String name, final String value) {
+        return new AppUserPreference(appUser, name, value);
+    }
+
+    public void updateValue(final String newValue) {
+        this.value = newValue;
+    }
+
+    public String getName() {
+        return this.name;
+    }
+
+    public String getValue() {
+        return this.value;
+    }
+
+    public AppUser getAppUser() {
+        return this.appUser;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/AppUserPreferenceRepository.java

@@ -0,0 +1,10 @@
+package org.apache.fineract.useradministration.domain;
+
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface AppUserPreferenceRepository extends JpaRepository<AppUserPreference, Long> {
+
+    Optional<AppUserPreference> findByAppUserIdAndName(Long appUserId, String name);
+
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/UserPendingRequest.java

@@ -0,0 +1,113 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Table;
+import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import lombok.AccessLevel;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+import org.apache.fineract.infrastructure.core.domain.AbstractPersistableCustom;
+
+@Entity
+@Table(name = "m_user_pending_request")
+@NoArgsConstructor(access = AccessLevel.PROTECTED)
+@Getter
+@Setter
+public class UserPendingRequest extends AbstractPersistableCustom<Long> {
+
+    @Column(name = "user_id")
+    private Long userId;
+
+    @Column(name = "request_type", nullable = false, length = 20)
+    private String requestType;
+
+    @Column(name = "status", nullable = false, length = 20)
+    private String status;
+
+    @Column(name = "payload_json", nullable = false)
+    private String payloadJson;
+
+    @Column(name = "original_json")
+    private String originalJson;
+
+    @Column(name = "password_hash")
+    private String passwordHash;
+
+    @Column(name = "maker_id", nullable = false)
+    private Long makerId;
+
+    @Column(name = "submitted_date", nullable = false)
+    private OffsetDateTime submittedDate;
+
+    @Column(name = "checker_id")
+    private Long checkerId;
+
+    @Column(name = "checked_date")
+    private OffsetDateTime checkedDate;
+
+    @Column(name = "reject_reason", length = 500)
+    private String rejectReason;
+
+    @Column(name = "pending_lock_key", length = 100, unique = true)
+    private String pendingLockKey;
+
+    public static UserPendingRequest create(final UserPendingRequestType requestType, final Long userId,
+            final String payloadJson, final String originalJson, final String passwordHash,
+            final Long makerId, final String pendingLockKey) {
+        final UserPendingRequest request = new UserPendingRequest();
+        request.requestType = requestType.name();
+        request.userId = userId;
+        request.status = UserPendingRequestStatus.PENDING.name();
+        request.payloadJson = payloadJson;
+        request.originalJson = originalJson;
+        request.passwordHash = passwordHash;
+        request.makerId = makerId;
+        request.submittedDate = OffsetDateTime.now(ZoneOffset.UTC);
+        request.pendingLockKey = pendingLockKey;
+        return request;
+    }
+
+    public boolean isPending() {
+        return UserPendingRequestStatus.PENDING.name().equals(this.status);
+    }
+
+    public boolean isMadeBy(final Long appUserId) {
+        return this.makerId != null && this.makerId.equals(appUserId);
+    }
+
+    public void approve(final Long checkerId) {
+        this.status = UserPendingRequestStatus.APPROVED.name();
+        this.checkerId = checkerId;
+        this.checkedDate = OffsetDateTime.now(ZoneOffset.UTC);
+        this.pendingLockKey = null;
+    }
+
+    public void reject(final Long checkerId, final String reason) {
+        this.status = UserPendingRequestStatus.REJECTED.name();
+        this.checkerId = checkerId;
+        this.checkedDate = OffsetDateTime.now(ZoneOffset.UTC);
+        this.rejectReason = reason;
+        this.pendingLockKey = null;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/UserPendingRequestRepository.java

@@ -0,0 +1,30 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.domain;
+
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
+
+public interface UserPendingRequestRepository extends JpaRepository<UserPendingRequest, Long>, JpaSpecificationExecutor<UserPendingRequest> {
+
+    Optional<UserPendingRequest> findByPendingLockKey(String pendingLockKey);
+
+    boolean existsByPendingLockKey(String pendingLockKey);
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/UserPendingRequestRepositoryWrapper.java

@@ -0,0 +1,49 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.domain;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.useradministration.exception.UserPendingRequestNotFoundException;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+public class UserPendingRequestRepositoryWrapper {
+
+    private final UserPendingRequestRepository repository;
+
+    @Transactional(readOnly = true)
+    public UserPendingRequest findOneWithNotFoundDetection(final Long id) {
+        return this.repository.findById(id).orElseThrow(() -> new UserPendingRequestNotFoundException(id));
+    }
+
+    public UserPendingRequest saveAndFlush(final UserPendingRequest request) {
+        return this.repository.saveAndFlush(request);
+    }
+
+    public UserPendingRequest save(final UserPendingRequest request) {
+        return this.repository.save(request);
+    }
+
+    @Transactional(readOnly = true)
+    public boolean existsByPendingLockKey(final String pendingLockKey) {
+        return this.repository.existsByPendingLockKey(pendingLockKey);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/UserPendingRequestStatus.java

@@ -0,0 +1,37 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.domain;
+
+public enum UserPendingRequestStatus {
+    PENDING,
+    APPROVED,
+    REJECTED;
+
+    public static UserPendingRequestStatus fromString(final String status) {
+        if (status == null) {
+            return null;
+        }
+        for (final UserPendingRequestStatus requestStatus : values()) {
+            if (requestStatus.name().equalsIgnoreCase(status)) {
+                return requestStatus;
+            }
+        }
+        throw new IllegalArgumentException("Unknown UserPendingRequestStatus: " + status);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/domain/UserPendingRequestType.java

@@ -0,0 +1,36 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.domain;
+
+public enum UserPendingRequestType {
+    CREATE_USER,
+    UPDATE_USER;
+
+    public static UserPendingRequestType fromString(final String type) {
+        if (type == null) {
+            return null;
+        }
+        for (final UserPendingRequestType requestType : values()) {
+            if (requestType.name().equalsIgnoreCase(type)) {
+                return requestType;
+            }
+        }
+        throw new IllegalArgumentException("Unknown UserPendingRequestType: " + type);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/exception/UserPendingRequestNotFoundException.java

@@ -0,0 +1,28 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.exception;
+
+import org.apache.fineract.infrastructure.core.exception.AbstractPlatformResourceNotFoundException;
+
+public class UserPendingRequestNotFoundException extends AbstractPlatformResourceNotFoundException {
+
+    public UserPendingRequestNotFoundException(final Long id) {
+        super("error.msg.userpendingrequest.id.invalid", "User pending request with identifier " + id + " does not exist", id);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/AppUserPreferenceReadPlatformService.java

@@ -0,0 +1,5 @@
+package org.apache.fineract.useradministration.service;
+
+public interface AppUserPreferenceReadPlatformService {
+    String getPreferenceValue(Long appUserId, String name);
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/AppUserPreferenceReadPlatformServiceImpl.java

@@ -0,0 +1,20 @@
+package org.apache.fineract.useradministration.service;
+
+import java.util.Optional;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.useradministration.domain.AppUserPreference;
+import org.apache.fineract.useradministration.domain.AppUserPreferenceRepository;
+import org.springframework.stereotype.Service;
+
+@Service
+@RequiredArgsConstructor
+public class AppUserPreferenceReadPlatformServiceImpl implements AppUserPreferenceReadPlatformService {
+
+    private final AppUserPreferenceRepository appUserPreferenceRepository;
+
+    @Override
+    public String getPreferenceValue(Long appUserId, String name) {
+        Optional<AppUserPreference> pref = appUserPreferenceRepository.findByAppUserIdAndName(appUserId, name);
+        return pref.map(AppUserPreference::getValue).orElse(null);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/AppUserPreferenceWritePlatformService.java

@@ -0,0 +1,5 @@
+package org.apache.fineract.useradministration.service;
+
+public interface AppUserPreferenceWritePlatformService {
+    void updatePreference(Long appUserId, String name, String value);
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/AppUserPreferenceWritePlatformServiceImpl.java

@@ -0,0 +1,32 @@
+package org.apache.fineract.useradministration.service;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.apache.fineract.useradministration.domain.AppUserPreference;
+import org.apache.fineract.useradministration.domain.AppUserPreferenceRepository;
+import org.apache.fineract.useradministration.domain.AppUserRepository;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+public class AppUserPreferenceWritePlatformServiceImpl implements AppUserPreferenceWritePlatformService {
+
+    private final AppUserPreferenceRepository appUserPreferenceRepository;
+    private final AppUserRepository appUserRepository;
+
+    @Transactional
+    @Override
+    public void updatePreference(Long appUserId, String name, String value) {
+        AppUserPreference preference = appUserPreferenceRepository.findByAppUserIdAndName(appUserId, name).orElse(null);
+        if (preference == null) {
+            AppUser appUser = appUserRepository.findById(appUserId)
+                    .orElseThrow(() -> new PlatformDataIntegrityException("error.msg.user.id.invalid", "User not found"));
+            preference = AppUserPreference.create(appUser, name, value);
+        } else {
+            preference.updateValue(value);
+        }
+        appUserPreferenceRepository.saveAndFlush(preference);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingReadPlatformService.java

@@ -0,0 +1,30 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.service;
+
+import org.apache.fineract.infrastructure.core.service.Page;
+import org.apache.fineract.useradministration.data.UserPendingRequestData;
+
+public interface UserPendingReadPlatformService {
+
+    Page<UserPendingRequestData> retrieveAllPendingRequests(String status, String username, String fromDate, String toDate,
+            Integer offset, Integer limit);
+
+    UserPendingRequestData retrievePendingRequest(Long id);
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingReadPlatformServiceImpl.java

@@ -0,0 +1,329 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.service;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.time.OffsetDateTime;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.fineract.infrastructure.core.domain.JdbcSupport;
+import org.apache.fineract.infrastructure.core.serialization.GoogleGsonSerializerHelper;
+import org.apache.fineract.infrastructure.core.service.Page;
+import org.apache.fineract.useradministration.data.UserPendingRequestData;
+import org.apache.fineract.useradministration.domain.UserPendingRequest;
+import org.apache.fineract.useradministration.domain.UserPendingRequestRepositoryWrapper;
+import org.springframework.dao.EmptyResultDataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+public class UserPendingReadPlatformServiceImpl implements UserPendingReadPlatformService {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final UserPendingRequestRepositoryWrapper pendingRequestRepositoryWrapper;
+    private final Gson gson = GoogleGsonSerializerHelper.createSimpleGson();
+
+    private static final String SELECT_SQL = """
+            SELECT r.id AS id,
+                   r.user_id AS userId,
+                   r.request_type AS requestType,
+                   r.status AS status,
+                   r.payload_json AS payloadJson,
+                   r.original_json AS originalJson,
+                   r.maker_id AS makerId,
+                   maker.username AS makerUsername,
+                   r.submitted_date AS submittedDate,
+                   r.checker_id AS checkerId,
+                   checker.username AS checkerUsername,
+                   r.checked_date AS checkedDate,
+                   r.reject_reason AS rejectReason
+            FROM m_user_pending_request r
+            JOIN m_appuser maker ON maker.id = r.maker_id
+            LEFT JOIN m_appuser checker ON checker.id = r.checker_id
+            """;
+
+    @Override
+    @Transactional(readOnly = true)
+    public Page<UserPendingRequestData> retrieveAllPendingRequests(final String status, final String username,
+            final String fromDate, final String toDate, final Integer offset, final Integer limit) {
+        final StringBuilder where = new StringBuilder(" WHERE 1=1");
+        final List<Object> args = new ArrayList<>();
+
+        if (StringUtils.isNotBlank(status)) {
+            where.append(" AND r.status = ?");
+            args.add(status.trim().toUpperCase());
+        } else {
+            where.append(" AND r.status = 'PENDING'");
+        }
+
+        if (StringUtils.isNotBlank(fromDate)) {
+            where.append(" AND r.submitted_date::date >= ?::date");
+            args.add(fromDate);
+        }
+        if (StringUtils.isNotBlank(toDate)) {
+            where.append(" AND r.submitted_date::date <= ?::date");
+            args.add(toDate);
+        }
+
+        final String countSql = "SELECT COUNT(*) FROM m_user_pending_request r " + where;
+        final Long totalFilteredRecords = this.jdbcTemplate.queryForObject(countSql, Long.class, args.toArray());
+
+        final int pageOffset = offset == null ? 0 : offset;
+        final int pageLimit = limit == null ? 20 : limit;
+        final String pageSql = SELECT_SQL + where + " ORDER BY r.submitted_date DESC LIMIT ? OFFSET ?";
+        final List<Object> pageArgs = new ArrayList<>(args);
+        pageArgs.add(pageLimit);
+        pageArgs.add(pageOffset);
+
+        final List<UserPendingRequestData> items = this.jdbcTemplate.query(pageSql, new UserPendingRowMapper(), pageArgs.toArray());
+
+        return new Page<>(items, totalFilteredRecords == null ? 0 : totalFilteredRecords.intValue());
+    }
+
+    @Override
+    @Transactional(readOnly = true)
+    public UserPendingRequestData retrievePendingRequest(final Long id) {
+        final UserPendingRequest request = this.pendingRequestRepositoryWrapper.findOneWithNotFoundDetection(id);
+        final String sql = SELECT_SQL + " WHERE r.id = ?";
+        return this.jdbcTemplate.queryForObject(sql, new UserPendingDetailRowMapper(), id);
+    }
+
+    private static class UserPendingRowMapper implements RowMapper<UserPendingRequestData> {
+
+        @Override
+        public UserPendingRequestData mapRow(final ResultSet rs, final int rowNum) throws SQLException {
+            final Long id = rs.getLong("id");
+            final Long userId = JdbcSupport.getLong(rs, "userId");
+            final String requestType = rs.getString("requestType");
+            final String status = rs.getString("status");
+            final String payloadJson = rs.getString("payloadJson");
+            final Long makerId = rs.getLong("makerId");
+            final String makerUsername = rs.getString("makerUsername");
+            final OffsetDateTime submittedDate = rs.getObject("submittedDate", OffsetDateTime.class);
+            final Long checkerId = JdbcSupport.getLong(rs, "checkerId");
+            final String checkerUsername = rs.getString("checkerUsername");
+            final OffsetDateTime checkedDate = rs.getObject("checkedDate", OffsetDateTime.class);
+            final String rejectReason = rs.getString("rejectReason");
+
+            String username = null;
+            String firstname = null;
+            String lastname = null;
+            String email = null;
+            String mobileNo = null;
+            Long officeId = null;
+            String otpDeliveryMethod = null;
+
+            try {
+                if (payloadJson != null) {
+                    final JsonObject payloadObj = JsonParser.parseString(payloadJson).getAsJsonObject();
+                    if (payloadObj.has("username")) {
+                        username = payloadObj.get("username").getAsString();
+                    }
+                    if (payloadObj.has("firstname")) {
+                        firstname = payloadObj.get("firstname").getAsString();
+                    }
+                    if (payloadObj.has("lastname")) {
+                        lastname = payloadObj.get("lastname").getAsString();
+                    }
+                    if (payloadObj.has("email")) {
+                        email = payloadObj.get("email").getAsString();
+                    }
+                    if (payloadObj.has("mobileNo")) {
+                        mobileNo = payloadObj.get("mobileNo").getAsString();
+                    }
+                    if (payloadObj.has("officeId")) {
+                        officeId = payloadObj.get("officeId").getAsLong();
+                    }
+                    if (payloadObj.has("otpDeliveryMethod")) {
+                        otpDeliveryMethod = payloadObj.get("otpDeliveryMethod").getAsString();
+                    }
+                }
+            } catch (Exception ignored) {
+            }
+
+            return UserPendingRequestData.builder()
+                    .id(id)
+                    .userId(userId)
+                    .requestType(requestType)
+                    .status(status)
+                    .username(username)
+                    .firstname(firstname)
+                    .lastname(lastname)
+                    .email(email)
+                    .mobileNo(mobileNo)
+                    .officeId(officeId)
+                    .otpDeliveryMethod(otpDeliveryMethod)
+                    .makerId(makerId)
+                    .makerUsername(makerUsername)
+                    .submittedDate(submittedDate)
+                    .checkerId(checkerId)
+                    .checkerUsername(checkerUsername)
+                    .checkedDate(checkedDate)
+                    .rejectReason(rejectReason)
+                    .build();
+        }
+    }
+
+    private static class UserPendingDetailRowMapper implements RowMapper<UserPendingRequestData> {
+
+        @Override
+        public UserPendingRequestData mapRow(final ResultSet rs, final int rowNum) throws SQLException {
+            final Long id = rs.getLong("id");
+            final Long userId = JdbcSupport.getLong(rs, "userId");
+            final String requestType = rs.getString("requestType");
+            final String status = rs.getString("status");
+            final String payloadJson = rs.getString("payloadJson");
+            final String originalJson = rs.getString("originalJson");
+            final Long makerId = rs.getLong("makerId");
+            final String makerUsername = rs.getString("makerUsername");
+            final OffsetDateTime submittedDate = rs.getObject("submittedDate", OffsetDateTime.class);
+            final Long checkerId = JdbcSupport.getLong(rs, "checkerId");
+            final String checkerUsername = rs.getString("checkerUsername");
+            final OffsetDateTime checkedDate = rs.getObject("checkedDate", OffsetDateTime.class);
+            final String rejectReason = rs.getString("rejectReason");
+
+            final Map<String, Object> proposedValues = new LinkedHashMap<>();
+            final Map<String, Object> originalValues = new LinkedHashMap<>();
+
+            String username = null;
+            String firstname = null;
+            String lastname = null;
+            String email = null;
+            String mobileNo = null;
+            Long officeId = null;
+            String otpDeliveryMethod = null;
+            Boolean passwordNeverExpires = null;
+
+            try {
+                if (payloadJson != null) {
+                    final JsonObject payloadObj = JsonParser.parseString(payloadJson).getAsJsonObject();
+                    for (final String key : payloadObj.keySet()) {
+                        final JsonElement val = payloadObj.get(key);
+                        if ("password".equals(key) || "repeatPassword".equals(key)) {
+                            proposedValues.put("password", "Password will be set on approval");
+                        } else if (val.isJsonPrimitive()) {
+                            if (val.getAsJsonPrimitive().isBoolean()) {
+                                proposedValues.put(key, val.getAsBoolean());
+                            } else if (val.getAsJsonPrimitive().isNumber()) {
+                                proposedValues.put(key, val.getAsNumber());
+                            } else {
+                                proposedValues.put(key, val.getAsString());
+                            }
+                        } else if (val.isJsonArray()) {
+                            final List<String> list = new ArrayList<>();
+                            for (final JsonElement elem : val.getAsJsonArray()) {
+                                list.add(elem.getAsString());
+                            }
+                            proposedValues.put(key, list);
+                        }
+                    }
+
+                    if (proposedValues.containsKey("username")) {
+                        username = (String) proposedValues.get("username");
+                    }
+                    if (proposedValues.containsKey("firstname")) {
+                        firstname = (String) proposedValues.get("firstname");
+                    }
+                    if (proposedValues.containsKey("lastname")) {
+                        lastname = (String) proposedValues.get("lastname");
+                    }
+                    if (proposedValues.containsKey("email")) {
+                        email = (String) proposedValues.get("email");
+                    }
+                    if (proposedValues.containsKey("mobileNo")) {
+                        mobileNo = (String) proposedValues.get("mobileNo");
+                    }
+                    if (proposedValues.get("officeId") instanceof Number n) {
+                        officeId = n.longValue();
+                    }
+                    if (proposedValues.containsKey("otpDeliveryMethod")) {
+                        otpDeliveryMethod = (String) proposedValues.get("otpDeliveryMethod");
+                    }
+                    if (proposedValues.get("passwordNeverExpires") instanceof Boolean b) {
+                        passwordNeverExpires = b;
+                    }
+                }
+
+                if (originalJson != null) {
+                    final JsonObject origObj = JsonParser.parseString(originalJson).getAsJsonObject();
+                    for (final String key : origObj.keySet()) {
+                        final JsonElement val = origObj.get(key);
+                        if (val.isJsonPrimitive()) {
+                            if (val.getAsJsonPrimitive().isBoolean()) {
+                                originalValues.put(key, val.getAsBoolean());
+                            } else if (val.getAsJsonPrimitive().isNumber()) {
+                                originalValues.put(key, val.getAsNumber());
+                            } else {
+                                originalValues.put(key, val.getAsString());
+                            }
+                        } else if (val.isJsonArray()) {
+                            final List<String> list = new ArrayList<>();
+                            for (final JsonElement elem : val.getAsJsonArray()) {
+                                list.add(elem.getAsString());
+                            }
+                            originalValues.put(key, list);
+                        }
+                    }
+                    if (proposedValues.containsKey("password")) {
+                        originalValues.put("password", "[PROTECTED]");
+                    }
+                }
+            } catch (Exception ignored) {
+            }
+
+            return UserPendingRequestData.builder()
+                    .id(id)
+                    .userId(userId)
+                    .requestType(requestType)
+                    .status(status)
+                    .username(username)
+                    .firstname(firstname)
+                    .lastname(lastname)
+                    .email(email)
+                    .mobileNo(mobileNo)
+                    .officeId(officeId)
+                    .otpDeliveryMethod(otpDeliveryMethod)
+                    .passwordNeverExpires(passwordNeverExpires)
+                    .makerId(makerId)
+                    .makerUsername(makerUsername)
+                    .submittedDate(submittedDate)
+                    .checkerId(checkerId)
+                    .checkerUsername(checkerUsername)
+                    .checkedDate(checkedDate)
+                    .rejectReason(rejectReason)
+                    .originalValues(originalValues)
+                    .proposedValues(proposedValues)
+                    .build();
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformService.java

@@ -0,0 +1,33 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.service;
+
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+
+public interface UserPendingWritePlatformService {
+
+    CommandProcessingResult submitCreateUser(JsonCommand command);
+
+    CommandProcessingResult submitUpdateUser(Long userId, JsonCommand command);
+
+    CommandProcessingResult approvePendingRequest(Long id);
+
+    CommandProcessingResult rejectPendingRequest(Long id, JsonCommand command);
+}

fineract-provider/src/main/java/org/apache/fineract/useradministration/service/UserPendingWritePlatformServiceImpl.java

@@ -0,0 +1,386 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.useradministration.service;
+
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.fineract.infrastructure.configuration.domain.ConfigurationDomainService;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.core.serialization.GoogleGsonSerializerHelper;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.organisation.office.domain.Office;
+import org.apache.fineract.organisation.office.domain.OfficeRepositoryWrapper;
+import org.apache.fineract.organisation.staff.domain.Staff;
+import org.apache.fineract.organisation.staff.domain.StaffRepositoryWrapper;
+import org.apache.fineract.portfolio.client.domain.Client;
+import org.apache.fineract.portfolio.client.domain.ClientRepositoryWrapper;
+import org.apache.fineract.useradministration.mfa.domain.MfaFactorType;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.apache.fineract.useradministration.domain.AppUserRepository;
+import org.apache.fineract.useradministration.domain.Role;
+import org.apache.fineract.useradministration.domain.RoleRepository;
+import org.apache.fineract.useradministration.mfa.domain.UserMfaFactor;
+import org.apache.fineract.useradministration.mfa.domain.UserMfaFactorRepository;
+import org.apache.fineract.useradministration.domain.UserPendingRequest;
+import org.apache.fineract.useradministration.domain.UserPendingRequestRepository;
+import org.apache.fineract.useradministration.domain.UserPendingRequestRepositoryWrapper;
+import org.apache.fineract.useradministration.domain.UserPendingRequestType;
+import org.apache.fineract.useradministration.exception.RoleNotFoundException;
+import org.apache.fineract.useradministration.exception.UserNotFoundException;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class UserPendingWritePlatformServiceImpl implements UserPendingWritePlatformService {
+
+    private final PlatformSecurityContext context;
+    private final UserPendingRequestRepositoryWrapper pendingRequestRepositoryWrapper;
+    private final UserPendingRequestRepository pendingRequestRepository;
+    private final AppUserRepository appUserRepository;
+    private final OfficeRepositoryWrapper officeRepositoryWrapper;
+    private final RoleRepository roleRepository;
+    private final StaffRepositoryWrapper staffRepositoryWrapper;
+    private final ClientRepositoryWrapper clientRepositoryWrapper;
+    private final UserMfaFactorRepository userMfaFactorRepository;
+    private final ConfigurationDomainService configurationDomainService;
+    private final PasswordEncoder passwordEncoder;
+    private final UserDataValidator fromApiJsonDeserializer;
+    private final FromJsonHelper fromApiJsonHelper;
+
+    @Override
+    @Transactional
+    public CommandProcessingResult submitCreateUser(final JsonCommand command) {
+        final AppUser maker = this.context.authenticatedUser();
+
+        this.fromApiJsonDeserializer.validateForCreate(command.json());
+
+        final String username = command.stringValueOfParameterNamed("username");
+        final String email = command.stringValueOfParameterNamed("email");
+        final String mobileNo = command.stringValueOfParameterNamed("mobileNo");
+
+        // Pre-flight checks on live users and pending creations
+        if (this.appUserRepository.findAppUserByName(username) != null) {
+            throw new PlatformDataIntegrityException("error.msg.user.duplicate.username",
+                    "User with username " + username + " already exists.", "username", username);
+        }
+
+        final String lockKey = "CREATE_USER:" + username.toLowerCase();
+        if (this.pendingRequestRepository.existsByPendingLockKey(lockKey)) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.duplicate",
+                    "A pending creation request for username '" + username + "' is already awaiting checker approval.", username);
+        }
+
+        assertEmailAndMobileUnique(email, mobileNo, null);
+
+        final JsonObject jsonObject = JsonParser.parseString(command.json()).getAsJsonObject();
+        String passwordHash = null;
+        if (jsonObject.has("password") && !jsonObject.get("password").isJsonNull()) {
+            final String rawPassword = jsonObject.get("password").getAsString();
+            if (!rawPassword.isBlank()) {
+                passwordHash = this.passwordEncoder.encode(rawPassword);
+            }
+            jsonObject.addProperty("password", "[PROTECTED]");
+            if (jsonObject.has("repeatPassword")) {
+                jsonObject.addProperty("repeatPassword", "[PROTECTED]");
+            }
+        }
+
+        final String sanitizedPayload = jsonObject.toString();
+        final UserPendingRequest request = UserPendingRequest.create(UserPendingRequestType.CREATE_USER, null,
+                sanitizedPayload, null, passwordHash, maker.getId(), lockKey);
+
+        final UserPendingRequest saved = this.pendingRequestRepositoryWrapper.saveAndFlush(request);
+
+        return new CommandProcessingResultBuilder()
+                .withEntityId(saved.getId())
+                .setRollbackTransaction(true)
+                .build();
+    }
+
+    @Override
+    @Transactional
+    public CommandProcessingResult submitUpdateUser(final Long userId, final JsonCommand command) {
+        final AppUser maker = this.context.authenticatedUser();
+        final AppUser userToUpdate = this.appUserRepository.findById(userId)
+                .orElseThrow(() -> new UserNotFoundException(userId));
+
+        this.fromApiJsonDeserializer.validateForUpdate(command.json(), maker);
+
+        final String email = command.stringValueOfParameterNamed("email");
+        final String mobileNo = command.stringValueOfParameterNamed("mobileNo");
+        assertEmailAndMobileUnique(email, mobileNo, userId);
+
+        final String lockKey = "UPDATE_USER:" + userId;
+        if (this.pendingRequestRepository.existsByPendingLockKey(lockKey)) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.duplicate",
+                    "A pending update request for user ID " + userId + " is already awaiting checker approval.", userId);
+        }
+
+        // Build point-in-time original JSON snapshot
+        final Map<String, Object> originalSnapshot = new LinkedHashMap<>();
+        originalSnapshot.put("username", userToUpdate.getUsername());
+        originalSnapshot.put("firstname", userToUpdate.getFirstname());
+        originalSnapshot.put("lastname", userToUpdate.getLastname());
+        originalSnapshot.put("email", userToUpdate.getEmail());
+        originalSnapshot.put("mobileNo", userToUpdate.getMobileNo());
+        originalSnapshot.put("officeId", userToUpdate.getOffice() != null ? userToUpdate.getOffice().getId() : null);
+        originalSnapshot.put("officeName", userToUpdate.getOffice() != null ? userToUpdate.getOffice().getName() : null);
+        originalSnapshot.put("staffId", userToUpdate.getStaff() != null ? userToUpdate.getStaff().getId() : null);
+        originalSnapshot.put("passwordNeverExpires", userToUpdate.getPasswordNeverExpires());
+        originalSnapshot.put("isSelfServiceUser", userToUpdate.isSelfServiceUser());
+        final Set<String> roleNames = new HashSet<>();
+        final Set<Long> roleIds = new HashSet<>();
+        if (userToUpdate.getRoles() != null) {
+            for (final Role r : userToUpdate.getRoles()) {
+                roleNames.add(r.getName());
+                roleIds.add(r.getId());
+            }
+        }
+        originalSnapshot.put("roles", roleIds);
+        originalSnapshot.put("roleNames", roleNames);
+        final String originalJson = GoogleGsonSerializerHelper.createSimpleGson().toJson(originalSnapshot);
+
+        final JsonObject jsonObject = JsonParser.parseString(command.json()).getAsJsonObject();
+        String passwordHash = null;
+        if (jsonObject.has("password") && !jsonObject.get("password").isJsonNull()) {
+            final String rawPassword = jsonObject.get("password").getAsString();
+            if (!rawPassword.isBlank()) {
+                passwordHash = this.passwordEncoder.encode(rawPassword);
+            }
+            jsonObject.addProperty("password", "[PROTECTED]");
+            if (jsonObject.has("repeatPassword")) {
+                jsonObject.addProperty("repeatPassword", "[PROTECTED]");
+            }
+        }
+
+        final String sanitizedPayload = jsonObject.toString();
+        final UserPendingRequest request = UserPendingRequest.create(UserPendingRequestType.UPDATE_USER, userId,
+                sanitizedPayload, originalJson, passwordHash, maker.getId(), lockKey);
+
+        final UserPendingRequest saved = this.pendingRequestRepositoryWrapper.saveAndFlush(request);
+
+        return new CommandProcessingResultBuilder()
+                .withEntityId(saved.getId())
+                .setRollbackTransaction(true)
+                .build();
+    }
+
+    @Override
+    @Transactional
+    public CommandProcessingResult approvePendingRequest(final Long id) {
+        final AppUser checker = this.context.authenticatedUser();
+        final UserPendingRequest request = this.pendingRequestRepositoryWrapper.findOneWithNotFoundDetection(id);
+
+        if (!request.isPending()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.not.pending",
+                    "User pending request " + id + " has already been actioned.", id);
+        }
+
+        if (request.isMadeBy(checker.getId())) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.self.approval",
+                    "You cannot approve a user request you submitted yourself — a different user must action it.", id);
+        }
+
+        final Long resourceId;
+        if (UserPendingRequestType.CREATE_USER.name().equals(request.getRequestType())) {
+            resourceId = finalizeCreateUser(request);
+        } else if (UserPendingRequestType.UPDATE_USER.name().equals(request.getRequestType())) {
+            resourceId = finalizeUpdateUser(request);
+        } else {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.type.invalid",
+                    "Unknown request type: " + request.getRequestType(), request.getRequestType());
+        }
+
+        request.approve(checker.getId());
+        this.pendingRequestRepositoryWrapper.saveAndFlush(request);
+
+        return new CommandProcessingResultBuilder()
+                .withEntityId(resourceId)
+                .withResourceIdAsString(resourceId.toString())
+                .build();
+    }
+
+    @Override
+    @Transactional
+    public CommandProcessingResult rejectPendingRequest(final Long id, final JsonCommand command) {
+        final AppUser checker = this.context.authenticatedUser();
+        final UserPendingRequest request = this.pendingRequestRepositoryWrapper.findOneWithNotFoundDetection(id);
+
+        if (!request.isPending()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.not.pending",
+                    "User pending request " + id + " has already been actioned.", id);
+        }
+
+        if (request.isMadeBy(checker.getId())) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.self.approval",
+                    "You cannot reject a user request you submitted yourself — a different user must action it.", id);
+        }
+
+        String reason = command != null ? command.stringValueOfParameterNamedAllowingNull("reason") : null;
+        if (reason == null && command != null) {
+            reason = command.stringValueOfParameterNamedAllowingNull("rejectReason");
+        }
+        if (reason == null || reason.isBlank()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.userpendingrequest.reject.reason.required",
+                    "A reason is required to reject a user pending request.", id);
+        }
+
+        request.reject(checker.getId(), reason);
+        this.pendingRequestRepositoryWrapper.saveAndFlush(request);
+
+        return new CommandProcessingResultBuilder()
+                .withEntityId(request.getId())
+                .withResourceIdAsString(request.getId().toString())
+                .build();
+    }
+
+    private Long finalizeCreateUser(final UserPendingRequest request) {
+        final JsonElement parsedElement = this.fromApiJsonHelper.parse(request.getPayloadJson());
+        final JsonCommand replay = JsonCommand.fromJsonElement(null, parsedElement, this.fromApiJsonHelper);
+
+        final Long officeId = replay.longValueOfParameterNamed("officeId");
+        final Office userOffice = this.officeRepositoryWrapper.findOneWithNotFoundDetection(officeId);
+
+        final String[] roles = replay.arrayValueOfParameterNamed("roles");
+        final Set<Role> allRoles = assembleSetOfRoles(roles);
+
+        final Long staffId = replay.longValueOfParameterNamed("staffId");
+        final Staff linkedStaff = staffId != null
+                ? this.staffRepositoryWrapper.findByOfficeWithNotFoundDetection(staffId, userOffice.getId())
+                : null;
+
+        final Collection<Client> clients = null;
+
+        final AppUser appUser = AppUser.fromJson(userOffice, linkedStaff, allRoles, clients, replay);
+
+        if (this.configurationDomainService.isForcePasswordResetOnFirstLoginEnabled()) {
+            appUser.updatePasswordResetRequired(true);
+        }
+
+        // Set pre-hashed password
+        if (request.getPasswordHash() != null) {
+            appUser.updatePassword(request.getPasswordHash());
+        }
+
+        this.appUserRepository.saveAndFlush(appUser);
+
+        // MFA Enrollment
+        final String otpDeliveryMethod = replay.stringValueOfParameterNamed("otpDeliveryMethod");
+        if (otpDeliveryMethod != null) {
+            final MfaFactorType factorType = MfaFactorType.fromString(otpDeliveryMethod);
+            final UserMfaFactor factor = new UserMfaFactor();
+            factor.setAppUser(appUser);
+            factor.setFactorType(factorType);
+            factor.setDestination(factorType == MfaFactorType.SMS ? appUser.getMobileNo() : appUser.getEmail());
+            factor.setVerified(true);
+            factor.setVerifiedOn(OffsetDateTime.now(ZoneOffset.UTC));
+            this.userMfaFactorRepository.save(factor);
+        }
+
+        return appUser.getId();
+    }
+
+    private Long finalizeUpdateUser(final UserPendingRequest request) {
+        final AppUser userToUpdate = this.appUserRepository.findById(request.getUserId())
+                .orElseThrow(() -> new UserNotFoundException(request.getUserId()));
+
+        final JsonElement parsedElement = this.fromApiJsonHelper.parse(request.getPayloadJson());
+        final JsonCommand replay = JsonCommand.fromJsonElement(request.getUserId(), parsedElement, this.fromApiJsonHelper);
+
+        final Map<String, Object> changes = userToUpdate.update(replay, null, null);
+
+        if (changes.containsKey("officeId")) {
+            final Long officeId = (Long) changes.get("officeId");
+            final Office office = this.officeRepositoryWrapper.findOneWithNotFoundDetection(officeId);
+            userToUpdate.changeOffice(office);
+        }
+        if (changes.containsKey("staffId")) {
+            final Long staffId = (Long) changes.get("staffId");
+            Staff linkedStaff = null;
+            if (staffId != null) {
+                linkedStaff = this.staffRepositoryWrapper.findByOfficeWithNotFoundDetection(staffId, userToUpdate.getOffice().getId());
+            }
+            userToUpdate.changeStaff(linkedStaff);
+        }
+        if (changes.containsKey("roles")) {
+            final String[] roleIds = (String[]) changes.get("roles");
+            final Set<Role> allRoles = assembleSetOfRoles(roleIds);
+            userToUpdate.updateRoles(allRoles);
+        }
+        if (request.getPasswordHash() != null) {
+            userToUpdate.updatePassword(request.getPasswordHash());
+        }
+
+        this.appUserRepository.saveAndFlush(userToUpdate);
+        return userToUpdate.getId();
+    }
+
+    private Set<Role> assembleSetOfRoles(final String[] rolesArray) {
+        final Set<Role> allRoles = new HashSet<>();
+        if (!ObjectUtils.isEmpty(rolesArray)) {
+            for (final String roleId : rolesArray) {
+                final Long id = Long.valueOf(roleId);
+                final Role role = this.roleRepository.findById(id).orElseThrow(() -> new RoleNotFoundException(id));
+                allRoles.add(role);
+            }
+        }
+        return allRoles;
+    }
+
+    private void assertEmailAndMobileUnique(final String email, final String mobileNo, final Long excludeUserId) {
+        if (email != null && !email.isBlank()) {
+            final java.util.Optional<AppUser> emailOwner = excludeUserId == null
+                    ? this.appUserRepository.findByEmailIgnoreCase(email)
+                    : this.appUserRepository.findByEmailIgnoreCaseAndIdNot(email, excludeUserId);
+            if (emailOwner.isPresent()) {
+                throw new PlatformDataIntegrityException("error.msg.user.duplicate.email",
+                        "User with email " + email + " already exists.", "email", email);
+            }
+        }
+        if (mobileNo != null && !mobileNo.isBlank()) {
+            final java.util.Optional<AppUser> mobileOwner = excludeUserId == null
+                    ? this.appUserRepository.findByMobileNo(mobileNo)
+                    : this.appUserRepository.findByMobileNoAndIdNot(mobileNo, excludeUserId);
+            if (mobileOwner.isPresent()) {
+                throw new PlatformDataIntegrityException("error.msg.user.duplicate.mobile",
+                        "User with mobile number " + mobileNo + " already exists.", "mobileNo", mobileNo);
+            }
+        }
+    }
+}

fineract-provider/src/main/resources/application.properties

@@ -46,7 +46,7 @@ fineract.security.oauth2.client.registrations.frontend-client.require-authorizat
 fineract.tenant.host=${FINERACT_DEFAULT_TENANTDB_HOSTNAME:localhost}
 fineract.tenant.port=${FINERACT_DEFAULT_TENANTDB_PORT:5432}
 fineract.tenant.username=${FINERACT_DEFAULT_TENANTDB_UID:postgres}
-fineract.tenant.password=${FINERACT_DEFAULT_TENANTDB_PWD:Keshav@898966}
+fineract.tenant.password=${FINERACT_DEFAULT_TENANTDB_PWD:anshul@9009}
 fineract.tenant.parameters=${FINERACT_DEFAULT_TENANTDB_CONN_PARAMS:}
 fineract.tenant.timezone=${FINERACT_DEFAULT_TENANTDB_TIMEZONE:Asia/Kolkata}
 fineract.tenant.identifier=${FINERACT_DEFAULT_TENANTDB_IDENTIFIER:default}
@@ -181,9 +181,9 @@ fineract.loan.transactionprocessor.error-not-found-fail=${FINERACT_LOAN_TRANSACT
 fineract.loan.status-change-history-statuses=${FINERACT_LOAN_STATUS_CHANGE_HISTORY_STATUSES:NONE}
 
 fineract.content.regex-whitelist-enabled=${FINERACT_CONTENT_REGEX_WHITELIST_ENABLED:true}
-fineract.content.regex-whitelist=${FINERACT_CONTENT_REGEX_WHITELIST:.*\\.pdf$,.*\\.doc,.*\\.docx,.*\\.xls,.*\\.xlsx,.*\\.jpg,.*\\.jpeg,.*\\.png,.*\\.zip$}
+fineract.content.regex-whitelist=${FINERACT_CONTENT_REGEX_WHITELIST:.*\\.pdf$,.*\\.doc,.*\\.docx,.*\\.xls,.*\\.xlsx,.*\\.jpg,.*\\.jpeg,.*\\.png,.*\\.zip$,.*\\.csv$}
 fineract.content.mime-whitelist-enabled=${FINERACT_CONTENT_MIME_WHITELIST_ENABLED:true}
-fineract.content.mime-whitelist=${FINERACT_CONTENT_MIME_WHITELIST:application/pdf,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,image/jpeg,image/png,application/zip,application/x-zip-compressed,application/octet-stream}
+fineract.content.mime-whitelist=${FINERACT_CONTENT_MIME_WHITELIST:application/pdf,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,image/jpeg,image/png,application/zip,application/x-zip-compressed,application/octet-stream,text/csv}
 fineract.content.default-buffer-size=${FINERACT_CONTENT_DEFAULT_BUFFER_SIZE:8192}
 fineract.content.filesystem.enabled=${FINERACT_CONTENT_FILESYSTEM_ENABLED:true}
 fineract.content.filesystem.rootFolder=${FINERACT_CONTENT_FILESYSTEM_ROOT_FOLDER:${user.home}/.fineract}
@@ -407,7 +407,7 @@ server.tomcat.mbeanregistry.enabled=${FINERACT_SERVER_TOMCAT_MBEANREGISTRY_ENABL
 spring.datasource.hikari.driverClassName=${FINERACT_HIKARI_DRIVER_SOURCE_CLASS_NAME:org.postgresql.Driver}
 spring.datasource.hikari.jdbcUrl=${FINERACT_HIKARI_JDBC_URL:jdbc:postgresql://localhost:5432/fineract_tenants}
 spring.datasource.hikari.username=${FINERACT_HIKARI_USERNAME:postgres}
-spring.datasource.hikari.password=${FINERACT_HIKARI_PASSWORD:Keshav@898966}
+spring.datasource.hikari.password=${FINERACT_HIKARI_PASSWORD:anshul@9009}
 spring.datasource.hikari.minimumIdle=${FINERACT_HIKARI_MINIMUM_IDLE:3}
 spring.datasource.hikari.maximumPoolSize=${FINERACT_HIKARI_MAXIMUM_POOL_SIZE:10}
 spring.datasource.hikari.idleTimeout=${FINERACT_HIKARI_IDLE_TIMEOUT:60000}
@@ -665,7 +665,36 @@ fineract.openproject.project-id=${FINERACT_OPENPROJECT_PROJECT_ID:cbsnexora}
 fineract.openproject.api-token=${FINERACT_OPENPROJECT_API_TOKEN:57dd9f933f113c7274e3ed3d5ca82e1e45e040c857160975087694f4d39ff596}
 
 # ── DIP / MNRL Mobile Number Lookup ──────────────────────────────────────────
-fineract.mobile-lookup.base-url=${FINERACT_MOBILE_LOOKUP_BASE_URL:http://localhost:8080}
+# Checks a mobile number against the DoT Digital Intelligence Platform (suspected numbers) and the
+# Mobile Number Revocation List (disconnected numbers). The backend calls
+# GET {base-url}/api/v1/lookup/check?mobileNumber=... and expects the response shape documented in
+# MobileLookupResult.
+#
+# A number that cannot be checked is NOT treated as clean: an unreachable service is recorded as
+# SERVICE_UNAVAILABLE and the officer must either reject the number or record a written reason to
+# proceed. So a wrong base-url here does not silently wave numbers through — it stops onboarding.
+# ┌──────────────────────────────────────────────────────────────────────────┐
+# │ LOCAL TEST LOOKUP SERVICE — NOT THE REAL DoT DIP/MNRL ENDPOINT.          │
+# │                                                                          │
+# │ This default points at scripts/mock-dip-lookup-service.js on localhost   │
+# │ so onboarding can be demonstrated end to end. Its verdicts are invented; │
+# │ NO NUMBER IS ACTUALLY CHECKED AGAINST THE DoT. Every response carries    │
+# │ provider=MOCK_DIP_LOOKUP_TEST_ONLY, which is stored in the lookup log's  │
+# │ raw response so a mock check can never be mistaken for a real one.       │
+# │                                                                          │
+# │   node scripts/mock-dip-lookup-service.js                                │
+# │                                                                          │
+# │ BEFORE PRODUCTION: set FINERACT_MOBILE_LOOKUP_BASE_URL to the real       │
+# │ DIP/MNRL provider. Do not ship the mock.                                 │
+# └──────────────────────────────────────────────────────────────────────────┘
+fineract.mobile-lookup.base-url=${FINERACT_MOBILE_LOOKUP_BASE_URL:http://127.0.0.1:8090}
+# Set to false to skip the DIP/MNRL check entirely (no HTTP call at all, no need to run the mock
+# service) -- every number is then logged as CLEAN but stamped "LOOKUP_DISABLED_BY_CONFIG" so it is
+# never mistaken for a real pass.
+# Currently OFF by default for local work so nobody needs the mock service running. Set
+# FINERACT_MOBILE_LOOKUP_ENABLED=true (or flip the default below) before UAT/production, where the
+# check must actually run.
+fineract.mobile-lookup.enabled=${FINERACT_MOBILE_LOOKUP_ENABLED:false}
 
 # ── Login OTP (2FA) — uses LincPay credentials above ─────────────────────────
 fineract.security.otp.lincpay.generate-path=${FINERACT_OTP_LINCPAY_GENERATE_PATH:/mobile/generate-otp}

fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

@@ -510,7 +510,7 @@
     <include file="parts/0455_add_family_member_children_table.xml" relativeToChangelogFile="true"/>
     <!-- Two branches independently used 0456-0462 for unrelated migrations (share dividend vs
          KYC/AML). Both sets are already applied against real local databases under these exact
-         filenames, so neither is renumbered here -- Liquibase identifies a changeSet by its
+         filenames, so neither is renumbered here — Liquibase identifies a changeSet by its
          (id, author, filename) triplet, not by the numeric prefix, so the duplicate numbering is
          cosmetic only. Future migrations should start at 0463 to avoid a third collision. -->
     <include file="parts/0456_create_share_dividend_lock.xml" relativeToChangelogFile="true"/>
@@ -527,4 +527,22 @@
     <include file="parts/0460_create_aml_recurring_review.xml" relativeToChangelogFile="true"/>
     <include file="parts/0461_add_pan_declaration_to_client_kyc.xml" relativeToChangelogFile="true"/>
     <include file="parts/0462_add_aadhaar_enrolment_receipt_to_client_kyc.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0463_add_cash_disbursement_fields_to_dividend_claim_request.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0464_seed_dividend_claim_payment_type.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0463_add_authorized_signatory_client_ids_to_client_non_person.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0464_add_sanctions_alert_disposition.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0465_add_dip_override_and_client_status.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0465_create_loan_origination_pipeline.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0466_add_sanctions_str_fields.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0467_add_welcome_kit_return_tracking.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0468_add_address_id_to_welcome_kit_dispatch.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0469_create_database_export_request.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0466_create_m_appuser_preference.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0467_enable_glaccount_maker_checker.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0470_enable_cbs_base_interest_rate_maker_checker.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0471_enable_charge_maker_checker.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0472_enable_product_creation_maker_checker.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0474_enable_fixed_deposit_product_maker_checker.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0475_enable_admin_user_maker_checker.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0476_add_user_pending_request_and_enable_charge_mc.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0348_add_sponsor_dd_cash_charges_gl_mapping.xml

@@ -23,24 +23,31 @@
 
     <!-- Dedicated income GL account for charges/commission collected on sponsor bank DD issuance,
          as a child of the existing "INCOME HEAD" account (gl_code 10), matching the pattern
-         already used by "INCOME FROM LOAN" (gl_code 10.1) / "INCOME FROM ALL" (gl_code 10.2). -->
+         already used by "INCOME FROM LOAN" (gl_code 10.1) / "INCOME FROM ALL" (gl_code 10.2).
+         parent_id is resolved dynamically via subquery (not hardcoded) because the numeric id of
+         the "INCOME HEAD" row is not guaranteed to be the same across environments/fresh DBs. -->
     <changeSet author="fineract" id="0348-1-insert-dd-charges-income-gl-account">
+        <!-- Accept checksum from older DBs that ran the hardcoded parent_id=25 version before this file was fixed -->
+        <validCheckSum>9:c2bc9949d0b0ab1972d1de1fb0131bd5</validCheckSum>
         <preConditions onFail="MARK_RAN">
             <not>
                 <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '10.3'</sqlCheck>
             </not>
         </preConditions>
-        <insert tableName="acc_gl_account">
+        <sql>
-            <column name="name" value="DD Issuance Charges Income"/>
+            INSERT INTO acc_gl_account (name, gl_code, parent_id, hierarchy, account_usage, classification_enum, disabled, manual_journal_entries_allowed, description)
-            <column name="gl_code" value="10.3"/>
+            VALUES (
-            <column name="parent_id" valueNumeric="25"/>
+                'DD Issuance Charges Income',
-            <column name="hierarchy" value="."/>
+                '10.3',
-            <column name="account_usage" valueNumeric="1"/>
+                (SELECT id FROM acc_gl_account WHERE gl_code = '10'),
-            <column name="classification_enum" valueNumeric="4"/>
+                '.',
-            <column name="disabled" valueBoolean="false"/>
+                1,
-            <column name="manual_journal_entries_allowed" valueBoolean="true"/>
+                4,
-            <column name="description" value="Commission/charges income collected from customers and walk-in purchasers when issuing a sponsor bank demand draft."/>
+                FALSE,
-        </insert>
+                TRUE,
+                'Commission/charges income collected from customers and walk-in purchasers when issuing a sponsor bank demand draft.'
+            );
+        </sql>
     </changeSet>
 
     <!-- Fineract's GL hierarchy path embeds the row's own auto-generated id, so it can only be
@@ -74,4 +81,4 @@
         </sql>
     </changeSet>
 
-</databaseChangeLog>
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0350_add_sponsor_dd_cash_receipt_suspense.xml

@@ -27,23 +27,29 @@
          immediately (the teller's cash-in-hand balance is correct as soon as cash is taken),
          without prematurely crediting the Sponsor DD Payable liability, which is only actually
          owed to the sponsor bank once the draft is approved/issued. -->
+    <!-- parent_id was previously hardcoded to 22, which only matched the default tenant's
+         auto-increment sequence. Resolved via gl_code subquery (like 0345-1) so this works
+         on any fresh or differently-seeded tenant. runOnChange lets existing databases whose
+         databasechangelog recorded the old checksum re-validate without a mismatch error;
+         the '9.4 already exists' precondition ensures it is MARK_RAN rather than re-inserted. -->
     <changeSet author="fineract" id="0350-1-insert-dd-cash-suspense-gl-account">
+        <!-- Accept checksum from older DBs that ran the hardcoded parent_id=22 version before this file was fixed -->
+        <validCheckSum>9:0a94b7ae03cdf15952a416c3f1a6434f</validCheckSum>
         <preConditions onFail="MARK_RAN">
-            <not>
+            <and>
-                <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '9.4'</sqlCheck>
+                <not>
-            </not>
+                    <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '9.4'</sqlCheck>
+                </not>
+                <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '9'</sqlCheck>
+            </and>
         </preConditions>
-        <insert tableName="acc_gl_account">
+        <sql>
-            <column name="name" value="DD Cash Received - Pending Approval"/>
+            INSERT INTO acc_gl_account (name, gl_code, parent_id, hierarchy, account_usage, classification_enum, disabled, manual_journal_entries_allowed, description)
-            <column name="gl_code" value="9.4"/>
+            SELECT 'DD Cash Received - Pending Approval', '9.4', parent.id, '.', 1, 2, FALSE, TRUE,
-            <column name="parent_id" valueNumeric="22"/>
+                   'Interim liability for cash physically received from a walk-in DD purchaser at submission time, pending manager approval of the issuance request. Cleared into Sponsor DD Payable + Charges Income on approval, or reversed back to Cash at Tellers on rejection.'
-            <column name="hierarchy" value="."/>
+            FROM acc_gl_account parent
-            <column name="account_usage" valueNumeric="1"/>
+            WHERE parent.gl_code = '9';
-            <column name="classification_enum" valueNumeric="2"/>
+        </sql>
-            <column name="disabled" valueBoolean="false"/>
-            <column name="manual_journal_entries_allowed" valueBoolean="true"/>
-            <column name="description" value="Interim liability for cash physically received from a walk-in DD purchaser at submission time, pending manager approval of the issuance request. Cleared into Sponsor DD Payable + Charges Income on approval, or reversed back to Cash at Tellers on rejection."/>
-        </insert>
     </changeSet>
 
     <changeSet author="fineract" id="0350-2-fix-dd-cash-suspense-hierarchy">

fineract-provider/src/main/resources/db/changelog/tenant/parts/0353_add_sponsor_dd_gst_on_charges.xml

@@ -23,23 +23,29 @@
 
     <!-- GST collected on DD issuance charges is money owed to the government, not bank income -
          it gets its own liability GL account, separate from Charges Income. -->
+    <!-- parent_id was previously hardcoded to 22, which only matched the default tenant's
+         auto-increment sequence. Resolved via gl_code subquery (like 0345-1 and 0350-1) so
+         this works on any fresh or differently-seeded tenant. runOnChange lets existing
+         databases re-validate without a checksum mismatch; the '9.5 already exists'
+         precondition ensures it is MARK_RAN rather than re-inserted. -->
     <changeSet author="fineract" id="0353-1-insert-gst-payable-gl-account">
+        <!-- Accept checksum from older DBs that ran the hardcoded parent_id=22 version before this file was fixed -->
+        <validCheckSum>9:b235f4e341d21adee8e1d2d280a2b0f4</validCheckSum>
         <preConditions onFail="MARK_RAN">
-            <not>
+            <and>
-                <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '9.5'</sqlCheck>
+                <not>
-            </not>
+                    <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '9.5'</sqlCheck>
+                </not>
+                <sqlCheck expectedResult="1">select count(*) from acc_gl_account where gl_code = '9'</sqlCheck>
+            </and>
         </preConditions>
-        <insert tableName="acc_gl_account">
+        <sql>
-            <column name="name" value="GST Payable on DD Charges"/>
+            INSERT INTO acc_gl_account (name, gl_code, parent_id, hierarchy, account_usage, classification_enum, disabled, manual_journal_entries_allowed, description)
-            <column name="gl_code" value="9.5"/>
+            SELECT 'GST Payable on DD Charges', '9.5', parent.id, '.', 1, 2, FALSE, TRUE,
-            <column name="parent_id" valueNumeric="22"/>
+                   'GST collected from customers/purchasers on Sponsor DD issuance charges, held pending remittance to the government - not bank income.'
-            <column name="hierarchy" value="."/>
+            FROM acc_gl_account parent
-            <column name="account_usage" valueNumeric="1"/>
+            WHERE parent.gl_code = '9';
-            <column name="classification_enum" valueNumeric="2"/>
+        </sql>
-            <column name="disabled" valueBoolean="false"/>
-            <column name="manual_journal_entries_allowed" valueBoolean="true"/>
-            <column name="description" value="GST collected from customers/purchasers on Sponsor DD issuance charges, held pending remittance to the government - not bank income."/>
-        </insert>
     </changeSet>
 
     <changeSet author="fineract" id="0353-2-fix-gst-payable-hierarchy">

fineract-provider/src/main/resources/db/changelog/tenant/parts/0463_add_authorized_signatory_client_ids_to_client_non_person.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.3.xsd">
+
+    <!--
+        Authorized signatories of a non-individual client are picked from existing clients, and each
+        one carries its own PAN and DIN verification. Only their display names were ever stored, in
+        authorized_signatory, so re-opening the client for edit could show who had been recorded but
+        could not link back to them: the client ids, and with them the DIN verification trail behind
+        each signatory, were lost the moment the form was closed.
+
+        Stored as a comma-separated list of client ids, ordered to match authorized_signatory, rather
+        than as a child table. The signatory list is only ever read and written whole, alongside the
+        rest of the non-person block, and pairing it with the existing name column keeps the two in
+        step; a join table would need its own lifecycle for no gain here.
+    -->
+    <changeSet id="0463-non-person-authorized-signatory-client-ids" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_client_non_person" columnName="authorized_signatory_client_ids"/></not>
+        </preConditions>
+        <addColumn tableName="m_client_non_person">
+            <column name="authorized_signatory_client_ids" type="VARCHAR(500)"/>
+        </addColumn>
+    </changeSet>
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0463_add_cash_disbursement_fields_to_dividend_claim_request.xml

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- The cash leg of a dividend claim now waits for a cashier to redeem a token number at
+         Transaction Entry (mirroring m_clerk_withdrawal_request) instead of being handed over the
+         instant a manager approves the claim. cash_status tracks only that physical hand-over
+         lifecycle, independently of the claim's own maker-checker status column, since a single
+         claim can also carry loan/savings legs that are unaffected by this. -->
+    <changeSet id="0463_add_cash_disbursement_fields_to_dividend_claim_request" author="CBS">
+        <addColumn tableName="m_share_dividend_claim_request">
+            <column name="tok_no" type="VARCHAR(50)"/>
+            <column name="cash_status" type="VARCHAR(30)"/>
+            <column name="cashier_id" type="BIGINT"/>
+            <column name="disbursed_by" type="VARCHAR(150)"/>
+            <column name="disbursed_at" type="TIMESTAMP"/>
+            <column name="disbursement_denomination_data" type="TEXT"/>
+        </addColumn>
+        <createIndex tableName="m_share_dividend_claim_request" indexName="idx_dcr_tok_no">
+            <column name="tok_no"/>
+        </createIndex>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0464_add_sanctions_alert_disposition.xml

@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Sanctions alert disposition.
+
+    A FLAGGED screening is not an outcome, it is a case that must be closed. Under Section 51-A
+    UAPA 1967 / Chapter IX of the RBI KYC Directions every positive hit has to end in either a
+    documented FALSE_POSITIVE (different person, reasons recorded, approved by the Principal
+    Officer) or a CONFIRMED_MATCH (escalated, reported to FIU-IND and the nodal officer, funds
+    frozen). These columns carry that lifecycle on the existing screening log row.
+-->
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.3.xsd">
+
+    <changeSet id="0464-sanctions-alert-disposition-columns" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_sanctions_screening_log" columnName="disposition"/></not>
+        </preConditions>
+        <addColumn tableName="m_sanctions_screening_log">
+            <!-- PENDING_REVIEW | FALSE_POSITIVE | CONFIRMED_MATCH. NULL for CLEAR screenings. -->
+            <column name="disposition" type="VARCHAR(30)"/>
+            <!-- Mandatory narrative: which identifiers were compared and why they do/don't match. -->
+            <column name="disposition_reason" type="TEXT"/>
+            <column name="reviewed_by" type="BIGINT"/>
+            <column name="reviewed_on" type="DATETIME"/>
+            <!-- Principal Officer. A false positive is only effective once this is set. -->
+            <column name="approved_by" type="BIGINT"/>
+            <column name="approved_on" type="DATETIME"/>
+            <column name="fiu_str_reference" type="VARCHAR(100)"/>
+            <column name="nodal_officer_informed_on" type="DATETIME"/>
+            <!-- Comma-separated savings account ids frozen by this alert, for the audit trail. -->
+            <column name="frozen_account_ids" type="VARCHAR(1000)"/>
+            <column name="frozen_on" type="DATETIME"/>
+        </addColumn>
+    </changeSet>
+
+    <!-- Backfill: every historical FLAGGED row is an unreviewed case, not a closed one. -->
+    <changeSet id="0464-sanctions-alert-backfill-pending" author="Antigravity">
+        <update tableName="m_sanctions_screening_log">
+            <column name="disposition" value="PENDING_REVIEW"/>
+            <where>screening_result = 'FLAGGED' AND disposition IS NULL</where>
+        </update>
+    </changeSet>
+
+    <changeSet id="0464-sanctions-alert-disposition-index" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><indexExists indexName="idx_sanctions_log_disposition"/></not>
+        </preConditions>
+        <createIndex tableName="m_sanctions_screening_log" indexName="idx_sanctions_log_disposition">
+            <column name="disposition"/>
+        </createIndex>
+    </changeSet>
+
+    <changeSet id="0464-sanctions-alert-permissions" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">
+                SELECT COUNT(*) FROM m_permission WHERE code = 'DISPOSE_SANCTIONS'
+            </sqlCheck>
+        </preConditions>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="DISPOSE_SANCTIONS"/>
+            <column name="entity_name" value="SANCTIONS"/>
+            <column name="action_name" value="DISPOSE"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="APPROVE_SANCTIONS"/>
+            <column name="entity_name" value="SANCTIONS"/>
+            <column name="action_name" value="APPROVE"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0464_seed_dividend_claim_payment_type.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Fineract's SavingsAccountTransactionDataValidator mandates paymentTypeId (notNull, no
+         exceptions) for a savings deposit command — even one posted internally by
+         DividendClaimRequestApiResource.approve() for the savings-credit leg of a dividend claim,
+         which has no real customer-facing payment instrument. Mirrors 0440's Share Redemption
+         Transfer payment type exactly: a fixed code_name to look up by (never a hardcoded numeric
+         id, which would break on any tenant seeded differently), left for an accountant to map to
+         a GL account via "Map Payment Types to Specific Funds" if desired. runOnChange lets this
+         file's wording/flag tweaks safely re-validate where it already ran. -->
+    <changeSet author="CBS" id="0464-1-seed-dividend-claim-payment-type" runOnChange="true">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">select count(*) from m_payment_type where code_name = 'DIVIDEND_CLAIM_SETTLEMENT'</sqlCheck>
+        </preConditions>
+        <insert tableName="m_payment_type">
+            <column name="value" value="Dividend Claim Settlement"/>
+            <column name="description" value="Internal book-transfer settlement of a dividend claim's loan/savings leg -- no real customer payment instrument"/>
+            <column name="is_cash_payment" valueBoolean="false"/>
+            <column name="order_position" valueNumeric="0"/>
+            <column name="code_name" value="DIVIDEND_CLAIM_SETTLEMENT"/>
+            <column name="is_system_defined" valueBoolean="false"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0465_add_dip_override_and_client_status.xml

@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    DIP / MNRL lookup outcome tracking.
+
+    A SUSPECTED number is a DoT cyber-fraud signal, not a legal prohibition, so the officer may
+    still proceed — but only with a recorded reason. These columns capture that decision on the
+    lookup log, and record on the client which DIP status their number actually returned, so a
+    number that was never really checked (DoT outage) is distinguishable from one that passed.
+-->
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.3.xsd">
+
+    <changeSet id="0465-mobile-lookup-override-columns" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_mobile_lookup_log" columnName="override_decision"/></not>
+        </preConditions>
+        <addColumn tableName="m_mobile_lookup_log">
+            <!-- PROCEEDED | REJECTED. Null when the lookup needed no decision (CLEAN). -->
+            <column name="override_decision" type="VARCHAR(20)"/>
+            <!-- Mandatory narrative when proceeding despite a DIP hit. -->
+            <column name="override_reason" type="TEXT"/>
+            <column name="decided_by" type="BIGINT"/>
+            <column name="decided_on" type="DATETIME"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0465-mobile-lookup-status-index" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><indexExists indexName="idx_mobile_lookup_status"/></not>
+        </preConditions>
+        <createIndex tableName="m_mobile_lookup_log" indexName="idx_mobile_lookup_status">
+            <column name="lookup_status"/>
+        </createIndex>
+    </changeSet>
+
+    <!--
+        dip_verified alone cannot distinguish "checked and clean" from "never checked because the
+        DoT service was down" — both were being stored as true. Record the actual status too.
+    -->
+    <changeSet id="0465-client-dip-status" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_client" columnName="dip_status"/></not>
+        </preConditions>
+        <addColumn tableName="m_client">
+            <column name="dip_status" type="VARCHAR(40)"/>
+            <column name="alternate_dip_status" type="VARCHAR(40)"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0465-mobile-lookup-permissions" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">
+                SELECT COUNT(*) FROM m_permission WHERE code = 'OVERRIDE_MOBILE_LOOKUP'
+            </sqlCheck>
+        </preConditions>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="OVERRIDE_MOBILE_LOOKUP"/>
+            <column name="entity_name" value="MOBILE_LOOKUP"/>
+            <column name="action_name" value="OVERRIDE"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0465_create_loan_origination_pipeline.xml

@@ -0,0 +1,224 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!--
+        Loan Origination Pipeline — the pre-disbursement sanctioning workflow every loan application
+        walks through (Application → KYC/OVD → CIC Credit Bureau Check → Field Investigation →
+        Personal Discussion → Credit Committee → Risk Approval → Legal Approval → Customer Signing →
+        Cheque/ACH → Post-Disbursement Check → Disbursed). Distinct from m_loan: this is the
+        *decisioning* record that exists before (and decides whether) a real loan account is ever
+        created, so it deliberately does not FK to m_loan except through fineract_loan_id once the
+        account is finally opened at disbursement.
+
+        Storage shape is a deliberate hybrid, and the three parts are disjoint (nothing stored twice):
+          - the dozen fields the Pipeline list / Channel-BC-Share reports / Target-vs-Actual actually
+            filter and aggregate on are real indexed columns, so those stay plain SQL;
+          - every other scalar field lives in `payload` as JSON. That bucket is "whatever else the
+            application object carries", not an allowlist, so a field added to the workflow later is
+            persisted with no schema or code change — the workflow has been gaining fields steadily
+            and an allowlist would silently drop them;
+          - the genuinely repeating parts (stage history, the four approvals, the four field-
+            investigation checks, the document checklists) are normalised into child tables below,
+            because they are queried across applications (e.g. everything one officer approved) and
+            an append-only stage history is an audit trail a co-operative bank has to be able to
+            produce on demand.
+    -->
+    <changeSet id="0465_create_loan_origination_pipeline" author="CBS">
+
+        <createTable tableName="m_loan_origination_application">
+            <column name="id" type="BIGINT" autoIncrement="true">
+                <constraints primaryKey="true" nullable="false"/>
+            </column>
+            <column name="application_no" type="VARCHAR(40)">
+                <constraints nullable="false" unique="true"
+                             uniqueConstraintName="uq_loan_origination_application_no"/>
+            </column>
+            <column name="applicant_name" type="VARCHAR(200)"/>
+            <column name="client_id" type="BIGINT"/>
+            <column name="branch_code" type="VARCHAR(10)"/>
+            <column name="channel" type="VARCHAR(20)"/>
+            <column name="bc_agent_name" type="VARCHAR(120)"/>
+            <column name="product_code" type="VARCHAR(10)"/>
+            <column name="requested_amount" type="DECIMAL(19,6)"/>
+            <column name="current_stage" type="VARCHAR(40)"/>
+            <column name="overall_status" type="VARCHAR(20)"/>
+            <column name="is_share_member" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="fineract_loan_id" type="BIGINT"/>
+            <!-- Every remaining scalar field of the application object, as JSON. TEXT (not JSONB)
+                 to match how this codebase already stores JSON (m_permission command_as_json,
+                 OtpLog request_payload) and to stay portable across MySQL/PostgreSQL. -->
+            <column name="payload" type="TEXT">
+                <constraints nullable="false"/>
+            </column>
+            <!-- Parsed credit-bureau report: deeply nested (accounts -> dpd grid -> monthly cells),
+                 read-only once parsed, and only ever rendered as a whole. Kept as its own JSON
+                 column rather than exploded into four more tables nothing would ever query. -->
+            <column name="cic_parsed_analysis" type="TEXT"/>
+            <column name="created_date" type="TIMESTAMP" defaultValueComputed="CURRENT_TIMESTAMP">
+                <constraints nullable="false"/>
+            </column>
+            <column name="last_modified_date" type="TIMESTAMP" defaultValueComputed="CURRENT_TIMESTAMP">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+
+        <createIndex tableName="m_loan_origination_application" indexName="idx_loi_app_current_stage">
+            <column name="current_stage"/>
+        </createIndex>
+        <createIndex tableName="m_loan_origination_application" indexName="idx_loi_app_overall_status">
+            <column name="overall_status"/>
+        </createIndex>
+        <createIndex tableName="m_loan_origination_application" indexName="idx_loi_app_branch_code">
+            <column name="branch_code"/>
+        </createIndex>
+        <createIndex tableName="m_loan_origination_application" indexName="idx_loi_app_client_id">
+            <column name="client_id"/>
+        </createIndex>
+
+        <!-- Append-only audit trail: one row per stage transition / action taken. -->
+        <createTable tableName="m_loan_origination_stage_history">
+            <column name="id" type="BIGINT" autoIncrement="true">
+                <constraints primaryKey="true" nullable="false"/>
+            </column>
+            <column name="application_id" type="BIGINT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="seq_no" type="INT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="stage" type="VARCHAR(40)"/>
+            <column name="action_date" type="VARCHAR(20)"/>
+            <column name="action_by" type="VARCHAR(120)"/>
+            <column name="outcome" type="VARCHAR(60)"/>
+            <column name="remarks" type="VARCHAR(1000)"/>
+        </createTable>
+
+        <addForeignKeyConstraint baseTableName="m_loan_origination_stage_history" baseColumnNames="application_id"
+                                 constraintName="fk_loi_stage_history_application"
+                                 referencedTableName="m_loan_origination_application" referencedColumnNames="id"
+                                 onDelete="CASCADE"/>
+        <createIndex tableName="m_loan_origination_stage_history" indexName="idx_loi_stage_history_application">
+            <column name="application_id"/>
+        </createIndex>
+
+        <!-- One row per approval level: creditCommitteeApproval / riskApproval / legalApproval /
+             postCheckApproval. Unique per application so an approval is updated, never duplicated. -->
+        <createTable tableName="m_loan_origination_approval">
+            <column name="id" type="BIGINT" autoIncrement="true">
+                <constraints primaryKey="true" nullable="false"/>
+            </column>
+            <column name="application_id" type="BIGINT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="approval_field" type="VARCHAR(40)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="decision" type="VARCHAR(30)"/>
+            <column name="approver_name" type="VARCHAR(120)"/>
+            <column name="approver_role" type="VARCHAR(120)"/>
+            <column name="decision_date" type="VARCHAR(20)"/>
+            <column name="remarks" type="VARCHAR(1000)"/>
+        </createTable>
+
+        <addForeignKeyConstraint baseTableName="m_loan_origination_approval" baseColumnNames="application_id"
+                                 constraintName="fk_loi_approval_application"
+                                 referencedTableName="m_loan_origination_application" referencedColumnNames="id"
+                                 onDelete="CASCADE"/>
+        <addUniqueConstraint tableName="m_loan_origination_approval" columnNames="application_id, approval_field"
+                             constraintName="uq_loi_approval_application_field"/>
+
+        <!-- One row per Field Investigation check: address / office / property / shop. -->
+        <createTable tableName="m_loan_origination_fi_check">
+            <column name="id" type="BIGINT" autoIncrement="true">
+                <constraints primaryKey="true" nullable="false"/>
+            </column>
+            <column name="application_id" type="BIGINT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="check_key" type="VARCHAR(40)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="status" type="VARCHAR(20)"/>
+            <column name="verified_by" type="VARCHAR(120)"/>
+            <column name="verified_date" type="VARCHAR(20)"/>
+            <column name="remarks" type="VARCHAR(1000)"/>
+            <column name="officer_assigned" type="VARCHAR(120)"/>
+            <column name="assigned_date" type="VARCHAR(20)"/>
+            <!-- Epoch millis the visit was assigned — drives the 48h SLA clock on the FI screen. -->
+            <column name="assigned_at" type="BIGINT"/>
+            <column name="latitude" type="VARCHAR(40)"/>
+            <column name="longitude" type="VARCHAR(40)"/>
+            <column name="photo_count" type="INT" defaultValueNumeric="0"/>
+        </createTable>
+
+        <addForeignKeyConstraint baseTableName="m_loan_origination_fi_check" baseColumnNames="application_id"
+                                 constraintName="fk_loi_fi_check_application"
+                                 referencedTableName="m_loan_origination_application" referencedColumnNames="id"
+                                 onDelete="CASCADE"/>
+        <addUniqueConstraint tableName="m_loan_origination_fi_check" columnNames="application_id, check_key"
+                             constraintName="uq_loi_fi_check_application_key"/>
+
+        <!-- Both document checklists in one table, discriminated by doc_kind: the product-specific
+             KYC/collateral papers (PRODUCT) and the Legal Approval paperwork (LEGAL). Officers can
+             add their own entries on the spot, hence is_custom. -->
+        <createTable tableName="m_loan_origination_document">
+            <column name="id" type="BIGINT" autoIncrement="true">
+                <constraints primaryKey="true" nullable="false"/>
+            </column>
+            <column name="application_id" type="BIGINT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="doc_kind" type="VARCHAR(20)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="doc_key" type="VARCHAR(60)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="label" type="VARCHAR(200)"/>
+            <column name="hint" type="VARCHAR(500)"/>
+            <column name="is_custom" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="submitted" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="seq_no" type="INT">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+
+        <addForeignKeyConstraint baseTableName="m_loan_origination_document" baseColumnNames="application_id"
+                                 constraintName="fk_loi_document_application"
+                                 referencedTableName="m_loan_origination_application" referencedColumnNames="id"
+                                 onDelete="CASCADE"/>
+        <createIndex tableName="m_loan_origination_document" indexName="idx_loi_document_application">
+            <column name="application_id"/>
+        </createIndex>
+
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0466_add_sanctions_str_fields.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Sanctions STR tracking.
+
+    A confirmed UNSC match is reportable to FIU-IND, so on approval it has to become a visible STR
+    item rather than a field buried in the sanctions log. It is kept on the screening log itself
+    and NOT written into m_aml_alert: an AML alert is built around a monetary transaction, whereas
+    a sanctions hit is triggered by who the customer is. Forcing it into that pipeline would mean
+    inventing a transaction that never happened and mixing two different kinds of suspicion in one
+    queue. The FIU screen surfaces them as a separate sanctions-STR stream.
+-->
+<databaseChangeLog
+        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <changeSet id="0466_add_sanctions_str_fields" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_sanctions_screening_log" columnName="str_status"/></not>
+        </preConditions>
+        <addColumn tableName="m_sanctions_screening_log">
+            <!-- NULL until approval; then PENDING_FILING -> FILED. -->
+            <column name="str_status" type="VARCHAR(30)"/>
+            <!-- Seven days from confirmation, per PMLA's seven-working-day STR deadline. -->
+            <column name="str_due_date" type="DATE"/>
+            <column name="str_raised_on" type="DATETIME"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0466_sanctions_str_status_index" author="Antigravity">
+        <preConditions onFail="MARK_RAN">
+            <not><indexExists indexName="idx_sanctions_log_str_status"/></not>
+        </preConditions>
+        <createIndex tableName="m_sanctions_screening_log" indexName="idx_sanctions_log_str_status">
+            <column name="str_status"/>
+        </createIndex>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0466_create_m_appuser_preference.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.3.xsd">
+    <changeSet id="0466_create_m_appuser_preference" author="fineract">
+        <preConditions onFail="MARK_RAN"><not><tableExists tableName="m_appuser_preference"/></not></preConditions>
+        <createTable tableName="m_appuser_preference">
+            <column name="id" type="BIGINT" autoIncrement="true">
+                <constraints primaryKey="true" nullable="false"/>
+            </column>
+            <column name="appuser_id" type="BIGINT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="name" type="VARCHAR(100)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="value" type="TEXT">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <addForeignKeyConstraint baseTableName="m_appuser_preference" baseColumnNames="appuser_id" constraintName="fk_m_appuser_preference_appuser_id" referencedTableName="m_appuser" referencedColumnNames="id"/>
+        <addUniqueConstraint tableName="m_appuser_preference" columnNames="appuser_id, name" constraintName="uq_appuser_preference_name"/>
+    </changeSet>
+</databaseChangeLog>