Enforce same-user maker-checker restriction

Replaces the previous DefaultApiClientBootstrapper (ApplicationRunner
minting a random key on first startup) with a plain Liquibase seed on the
tenant-store database: one fixed, well-known api_key_hash row, inserted
once via migration 0012, same on every deployment and every tenant --
exactly like this fork already seeds default codes/permissions, rather
than generating a secret at runtime.

The trade-off is explicit in the migration's own comment: a fixed key
checked into source is a bootstrap convenience, not a secret, and any
deployment beyond local/dev must rotate it (insert a new hash, deactivate
this row) before going live -- rotation is a direct m_api_client write,
same as the seed itself, since POST /v1/apiclients stays disabled.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fineract-accounting/src/main/java/org/apache/fineract/accounting/financialactivityaccount/serialization/FinancialActivityAccountDataValidator.java

@@ -45,6 +45,22 @@ public final class FinancialActivityAccountDataValidator {
      */
     private final Set<String> supportedParameters = FinancialActivityAccountsJsonInputParams.getAllValues();
 
+    /**
+     * Activities an administrator may map from the Financial Activity Mappings screen.
+     *
+     * Held in one place because create and update both validate against it, and the two lists had already drifted -
+     * update omitted the two cash activities, and neither offered the dividend activities beyond PAYABLE_DIVIDENDS even
+     * though the accounting code reads them. An activity the posting code resolves but this list omits can only ever be
+     * seeded by a migration, which is how DIVIDEND_PAID and RESERVE_FOR_DIVIDEND came to exist without being editable.
+     */
+    private static final Object[] MAPPABLE_FINANCIAL_ACTIVITIES = { FinancialActivity.ASSET_TRANSFER.getValue(),
+            FinancialActivity.LIABILITY_TRANSFER.getValue(), FinancialActivity.CASH_AT_MAINVAULT.getValue(),
+            FinancialActivity.CASH_AT_TELLER.getValue(), FinancialActivity.OPENING_BALANCES_TRANSFER_CONTRA.getValue(),
+            FinancialActivity.ASSET_FUND_SOURCE.getValue(), FinancialActivity.PAYABLE_DIVIDENDS.getValue(),
+            FinancialActivity.DIVIDEND_PAID.getValue(), FinancialActivity.RESERVE_FOR_DIVIDEND.getValue(),
+            FinancialActivity.DIVIDEND_FORFEITED_INCOME.getValue(), FinancialActivity.DISTRIBUTABLE_PROFIT.getValue(),
+            FinancialActivity.RETAINED_PROFIT.getValue(), FinancialActivity.DIVIDEND_ROUND_OFF.getValue() };
+
     private final String paramNameForFinancialActivity = FinancialActivityAccountsJsonInputParams.FINANCIAL_ACTIVITY_ID.getValue();
     private final String paramNameForGLAccount = FinancialActivityAccountsJsonInputParams.GL_ACCOUNT_ID.getValue();
 
@@ -59,11 +75,8 @@ public final class FinancialActivityAccountDataValidator {
         final JsonElement element = this.fromApiJsonHelper.parse(json);
 
         final Integer financialActivityId = this.fromApiJsonHelper.extractIntegerSansLocaleNamed(paramNameForFinancialActivity, element);
-        baseDataValidator.reset().parameter(paramNameForFinancialActivity).value(financialActivityId).notNull().isOneOfTheseValues(
+        baseDataValidator.reset().parameter(paramNameForFinancialActivity).value(financialActivityId).notNull()
-                FinancialActivity.ASSET_TRANSFER.getValue(), FinancialActivity.LIABILITY_TRANSFER.getValue(),
+                .isOneOfTheseValues(MAPPABLE_FINANCIAL_ACTIVITIES);
-                FinancialActivity.CASH_AT_MAINVAULT.getValue(), FinancialActivity.CASH_AT_TELLER.getValue(),
-                FinancialActivity.OPENING_BALANCES_TRANSFER_CONTRA.getValue(), FinancialActivity.ASSET_FUND_SOURCE.getValue(),
-                FinancialActivity.PAYABLE_DIVIDENDS.getValue());
 
         final Long glAccountId = this.fromApiJsonHelper.extractLongNamed(paramNameForGLAccount, element);
         baseDataValidator.reset().parameter(paramNameForGLAccount).value(glAccountId).notNull().integerGreaterThanZero();
@@ -86,10 +99,8 @@ public final class FinancialActivityAccountDataValidator {
         if (this.fromApiJsonHelper.parameterExists(paramNameForFinancialActivity, element)) {
             final Integer financialActivityId = this.fromApiJsonHelper.extractIntegerSansLocaleNamed(paramNameForFinancialActivity,
                     element);
-            baseDataValidator.reset().parameter(paramNameForFinancialActivity).value(financialActivityId).ignoreIfNull().isOneOfTheseValues(
+            baseDataValidator.reset().parameter(paramNameForFinancialActivity).value(financialActivityId).ignoreIfNull()
-                    FinancialActivity.ASSET_TRANSFER.getValue(), FinancialActivity.LIABILITY_TRANSFER.getValue(),
+                    .isOneOfTheseValues(MAPPABLE_FINANCIAL_ACTIVITIES);
-                    FinancialActivity.OPENING_BALANCES_TRANSFER_CONTRA.getValue(), FinancialActivity.ASSET_FUND_SOURCE.getValue(),
-                    FinancialActivity.PAYABLE_DIVIDENDS.getValue());
         }
 
         if (this.fromApiJsonHelper.parameterExists(paramNameForGLAccount, element)) {

fineract-accounting/src/main/java/org/apache/fineract/accounting/journalentry/exception/JournalEntryInvalidException.java

@@ -37,6 +37,7 @@ public class JournalEntryInvalidException extends AbstractPlatformDomainRuleExce
         DEBIT_CREDIT_ACCOUNT_OR_AMOUNT_EMPTY, //
         GL_ACCOUNT_DISABLED, //
         GL_ACCOUNT_MANUAL_ENTRIES_NOT_PERMITTED, //
+        GL_ACCOUNT_IS_HEADER, //
         INVALID_DEBIT_OR_CREDIT_ACCOUNTS; //
 
         public String errorMessage() {
@@ -58,6 +59,8 @@ public class JournalEntryInvalidException extends AbstractPlatformDomainRuleExce
                 return "Invalid debit or credit accounts are passed";
             } else if (name().equalsIgnoreCase("GL_ACCOUNT_MANUAL_ENTRIES_NOT_PERMITTED")) {
                 return "Target account does not allow manual adjustments";
+            } else if (name().equalsIgnoreCase("GL_ACCOUNT_IS_HEADER")) {
+                return "Target account is a Header account (a chart-of-accounts grouping node) and cannot receive a transaction directly";
             }
             return name();
         }
@@ -79,6 +82,8 @@ public class JournalEntryInvalidException extends AbstractPlatformDomainRuleExce
                 return "error.msg.glJournalEntry.invalid.debit.or.credit.accounts";
             } else if (name().equalsIgnoreCase("GL_ACCOUNT_MANUAL_ENTRIES_NOT_PERMITTED")) {
                 return "error.msg.glJournalEntry.invalid.account.manual.adjustments.not.permitted";
+            } else if (name().equalsIgnoreCase("GL_ACCOUNT_IS_HEADER")) {
+                return "error.msg.glJournalEntry.invalid.account.is.header";
             }
             return name();
         }

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/serialization/ProductToGLAccountMappingFromApiJsonDeserializer.java

@@ -279,9 +279,15 @@ public final class ProductToGLAccountMappingFromApiJsonDeserializer {
 
         if (AccountingValidations.isCashBasedAccounting(accountingRuleType)) {
 
+            // Optional, not mandatory like the three below: it names an account for cash physically
+            // received at the counter for a share purchase, which every register in this bank now
+            // books against the account the money actually reached instead. Left absent, a product
+            // simply carries no such mapping, and any code path that still needs one (a genuine
+            // over-the-counter collection) fails with a named "GL not mapped" error rather than
+            // silently assuming the till.
             final Long shareReferenceId = this.fromApiJsonHelper.extractLongNamed(SharesProductAccountingParams.SHARES_REFERENCE.getValue(),
                     element);
-            baseDataValidator.reset().parameter(SharesProductAccountingParams.SHARES_REFERENCE.getValue()).value(shareReferenceId).notNull()
+            baseDataValidator.reset().parameter(SharesProductAccountingParams.SHARES_REFERENCE.getValue()).value(shareReferenceId)
                     .integerGreaterThanZero();
 
             final Long shareSuspenseId = this.fromApiJsonHelper.extractLongNamed(SharesProductAccountingParams.SHARES_SUSPENSE.getValue(),

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/service/ProductToGLAccountMappingReadPlatformService.java

@@ -38,6 +38,8 @@ public interface ProductToGLAccountMappingReadPlatformService {
 
     Map<String, Object> fetchAccountMappingDetailsForSavingsProduct(Long savingsProductId, Integer accountingType);
 
+    Map<String, Object> fetchAccountMappingDetailsForCurrentProduct(Long currentProductId, Integer accountingType);
+
     List<PaymentTypeToGLAccountMapper> fetchPaymentTypeToFundSourceMappingsForSavingsProduct(Long savingsProductId);
 
     List<ChargeToGLAccountMapper> fetchFeeToIncomeAccountMappingsForSavingsProduct(Long savingsProductId);

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/service/ProductToGLAccountMappingReadPlatformServiceImpl.java

@@ -202,6 +202,20 @@ public class ProductToGLAccountMappingReadPlatformServiceImpl implements Product
         return accountMappingDetails;
     }
 
+    /** A current product's mappings, which live under their own CURRENT product type, laid out as a savings product's. */
+    @Override
+    public Map<String, Object> fetchAccountMappingDetailsForCurrentProduct(final Long currentProductId, final Integer accountingType) {
+        final List<ProductToGLAccountMapping> mappings = productToGLAccountMappingRepository.findAllRegularMappings(currentProductId,
+                PortfolioProductType.CURRENT.getValue());
+        if (AccountingValidations.isCashBasedAccounting(accountingType)) {
+            return setCashSavingsProductToGLAccountMaps(mappings);
+        }
+        if (AccountingValidations.isAccrualPeriodicBasedAccounting(accountingType)) {
+            return setAccrualPeriodicSavingsProductToGLAccountMaps(mappings);
+        }
+        return null;
+    }
+
     @Override
     public List<PaymentTypeToGLAccountMapper> fetchPaymentTypeToFundSourceMappingsForLoanProduct(final Long loanProductId) {
         return fetchPaymentTypeToFundSourceMappings(PortfolioProductType.LOAN, loanProductId);
@@ -426,6 +440,8 @@ public class ProductToGLAccountMappingReadPlatformServiceImpl implements Product
                     accountMappingDetails.put(SavingProductAccountingDataParams.INCOME_FROM_INTEREST.getValue(), glAccountData);
                 } else if (glAccountForSavings.equals(AccrualAccountsForSavings.ESCHEAT_LIABILITY)) {
                     accountMappingDetails.put(SavingProductAccountingDataParams.ESCHEAT_LIABILITY.getValue(), glAccountData);
+                } else if (glAccountForSavings.equals(AccrualAccountsForSavings.ROUNDING_ADJUSTMENT)) {
+                    accountMappingDetails.put(SavingProductAccountingDataParams.ROUNDING_ADJUSTMENT.getValue(), glAccountData);
                     // Expense
                 } else if (glAccountForSavings.equals(AccrualAccountsForSavings.INTEREST_ON_SAVINGS)) {
                     accountMappingDetails.put(SavingProductAccountingDataParams.INTEREST_ON_SAVINGS.getValue(), glAccountData);
@@ -470,6 +486,8 @@ public class ProductToGLAccountMappingReadPlatformServiceImpl implements Product
                     accountMappingDetails.put(SavingProductAccountingDataParams.INCOME_FROM_INTEREST.getValue(), glAccountData);
                 } else if (glAccountForSavings.equals(CashAccountsForSavings.ESCHEAT_LIABILITY)) {
                     accountMappingDetails.put(SavingProductAccountingDataParams.ESCHEAT_LIABILITY.getValue(), glAccountData);
+                } else if (glAccountForSavings.equals(CashAccountsForSavings.ROUNDING_ADJUSTMENT)) {
+                    accountMappingDetails.put(SavingProductAccountingDataParams.ROUNDING_ADJUSTMENT.getValue(), glAccountData);
                     // Expense
                 } else if (glAccountForSavings.equals(CashAccountsForSavings.INTEREST_ON_SAVINGS)) {
                     accountMappingDetails.put(SavingProductAccountingDataParams.INTEREST_ON_SAVINGS.getValue(), glAccountData);

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/service/SavingsProductToGLAccountMappingHelper.java

@@ -106,6 +106,20 @@ public class SavingsProductToGLAccountMappingHelper extends ProductToGLAccountMa
                 PortfolioProductType.SAVING);
     }
 
+    /**
+     * Create-or-merge, for an expense row a product may not have yet.
+     *
+     * The plain merge variant assumes the mapping already exists, which is true of every expense
+     * row that shipped with the product screen. A row added later — the rounding adjustment — is
+     * absent on every product created before it, so editing one of those has to create the
+     * mapping rather than fail looking for it.
+     */
+    public void createOrmergeSavingsToExpenseAccountMappingChanges(final JsonElement element, final String paramName,
+            final Long productId, final int accountTypeId, final Map<String, Object> changes) {
+        createOrmergeProductToAccountMappingChanges(element, paramName, productId, accountTypeId, changes, GLAccountType.EXPENSE,
+                PortfolioProductType.SAVING);
+    }
+
     /*** Abstractions for payments channel related to savings products ***/
 
     public void savePaymentChannelToFundSourceMappings(final JsonCommand command, final JsonElement element, final Long productId,
@@ -248,6 +262,15 @@ public class SavingsProductToGLAccountMappingHelper extends ProductToGLAccountMa
                         CashAccountsForSavings.TRANSFERS_SUSPENSE.toString(), changes);
                 createOrmergeSavingsToLiabilityAccountMappingChanges(element, SavingProductAccountingParams.ESCHEAT_LIABILITY.getValue(),
                         savingsProductId, CashAccountsForSavings.ESCHEAT_LIABILITY.getValue(), changes);
+                createOrmergeSavingsToExpenseAccountMappingChanges(element, SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(),
+                        savingsProductId, CashAccountsForSavings.ROUNDING_ADJUSTMENT.getValue(), changes);
+                // Interest Payable is editable on cash too, and optional. Interest posting routes
+                // through it on either basis, so a product can name one to carry interest declared
+                // but not yet credited; a product that names none still posts straight to Savings
+                // Control. Created-or-merged because a product configured before this row existed
+                // has no mapping to merge into.
+                createOrmergeSavingsToLiabilityAccountMappingChanges(element, SavingProductAccountingParams.INTEREST_PAYABLE.getValue(),
+                        savingsProductId, AccrualAccountsForSavings.INTEREST_PAYABLE.getValue(), changes);
             break;
             case ACCRUAL_PERIODIC:
                 // asset
@@ -308,6 +331,8 @@ public class SavingsProductToGLAccountMappingHelper extends ProductToGLAccountMa
 
                 createOrmergeSavingsToLiabilityAccountMappingChanges(element, SavingProductAccountingParams.ESCHEAT_LIABILITY.getValue(),
                         savingsProductId, AccrualAccountsForSavings.ESCHEAT_LIABILITY.getValue(), changes);
+                createOrmergeSavingsToExpenseAccountMappingChanges(element, SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(),
+                        savingsProductId, AccrualAccountsForSavings.ROUNDING_ADJUSTMENT.getValue(), changes);
 
             break;
             case ACCRUAL_UPFRONT:

fineract-accounting/src/main/java/org/apache/fineract/accounting/producttoaccountmapping/service/ShareProductToGLAccountMappingHelper.java

@@ -27,6 +27,7 @@ import org.apache.fineract.accounting.common.AccountingRuleType;
 import org.apache.fineract.accounting.glaccount.domain.GLAccountRepository;
 import org.apache.fineract.accounting.glaccount.domain.GLAccountRepositoryWrapper;
 import org.apache.fineract.accounting.glaccount.domain.GLAccountType;
+import org.apache.fineract.accounting.producttoaccountmapping.domain.ProductToGLAccountMapping;
 import org.apache.fineract.accounting.producttoaccountmapping.domain.ProductToGLAccountMappingRepository;
 import org.apache.fineract.infrastructure.codes.domain.CodeValueRepository;
 import org.apache.fineract.infrastructure.core.api.JsonCommand;
@@ -166,9 +167,9 @@ public class ShareProductToGLAccountMappingHelper extends ProductToGLAccountMapp
             case NONE:
             break;
             case CASH_BASED:
-                // asset
+                // asset -- the one optional mapping here, so unlike the three below it needs its own
-                mergeSharesToAssetAccountMappingChanges(element, SharesProductAccountingParams.SHARES_REFERENCE.getValue(), sharesProductId,
+                // handling for the case the field is now absent (see mergeOrRemoveSharesReferenceMapping).
-                        CashAccountsForShares.SHARES_REFERENCE.getValue(), CashAccountsForShares.SHARES_REFERENCE.toString(), changes);
+                mergeOrRemoveSharesReferenceMapping(element, sharesProductId, changes);
 
                 // income
                 mergeSharesToIncomeAccountMappingChanges(element, SharesProductAccountingParams.INCOME_FROM_FEES.getValue(),
@@ -194,4 +195,35 @@ public class ShareProductToGLAccountMappingHelper extends ProductToGLAccountMapp
     public void deleteSharesProductToGLAccountMapping(final Long sharesProductId) {
         deleteProductToGLAccountMapping(sharesProductId, PortfolioProductType.SHARES);
     }
+
+    /**
+     * Handles the one optional share-product mapping, Shares Reference, on an edit that does not change
+     * the accounting rule.
+     *
+     * <p>
+     * The other three mappings (Suspense, Income From Fees, Equity) are mandatory, so
+     * {@code mergeProductToAccountMappingChanges} only ever needs to handle "present and possibly
+     * changed" for them -- a null value there cannot happen without failing validation first. Shares
+     * Reference can legitimately be absent, and the shared merge helper (used across loan, savings and
+     * share products alike) only handles "present": it silently leaves an existing mapping row alone
+     * when the incoming value is null, rather than clearing it. Editing this one field out of an
+     * existing product would otherwise leave the product still carrying its old GL underneath, invisible
+     * on the edit form but still resolvable by any code path that looks it up directly.
+     */
+    private void mergeOrRemoveSharesReferenceMapping(final JsonElement element, final Long sharesProductId,
+            final Map<String, Object> changes) {
+        final Long shareReferenceId = this.fromApiJsonHelper.extractLongNamed(SharesProductAccountingParams.SHARES_REFERENCE.getValue(),
+                element);
+        if (shareReferenceId != null) {
+            mergeSharesToAssetAccountMappingChanges(element, SharesProductAccountingParams.SHARES_REFERENCE.getValue(), sharesProductId,
+                    CashAccountsForShares.SHARES_REFERENCE.getValue(), CashAccountsForShares.SHARES_REFERENCE.toString(), changes);
+            return;
+        }
+        final ProductToGLAccountMapping existing = this.accountMappingRepository.findCoreProductToFinAccountMapping(sharesProductId,
+                PortfolioProductType.SHARES.getValue(), CashAccountsForShares.SHARES_REFERENCE.getValue());
+        if (existing != null) {
+            this.accountMappingRepository.delete(existing);
+            changes.put(SharesProductAccountingParams.SHARES_REFERENCE.getValue(), null);
+        }
+    }
 }

fineract-core/src/main/java/org/apache/fineract/accounting/common/AccountingConstants.java

@@ -269,7 +269,15 @@ public final class AccountingConstants {
         OVERDRAFT_PORTFOLIO_CONTROL(11), //
         INCOME_FROM_INTEREST(12), //
         LOSSES_WRITTEN_OFF(13), //
-        ESCHEAT_LIABILITY(14); //
+        ESCHEAT_LIABILITY(14), //
+        /**
+         * Where the paise dropped from a cash closure are absorbed.
+         *
+         * Cash has no paise in circulation, so a closing balance of 9,883.79 is handed over as
+         * 9,883 and the 0.79 has to land somewhere other than the member's own ledger. Numbered
+         * well clear of the accrual slots so the two sets never collide as either grows.
+         */
+        ROUNDING_ADJUSTMENT(26); //
 
         private final Integer value;
 
@@ -317,7 +325,9 @@ public final class AccountingConstants {
         FEES_RECEIVABLE(15), //
         PENALTIES_RECEIVABLE(16), //
         INTEREST_PAYABLE(17), //
-        INTEREST_RECEIVABLE(18);
+        INTEREST_RECEIVABLE(18), //
+        /** Where the paise dropped from a cash closure are absorbed — see the cash enum. */
+        ROUNDING_ADJUSTMENT(26);
 
         private final Integer value;
 
@@ -372,7 +382,8 @@ public final class AccountingConstants {
         PENALTIES_RECEIVABLE("penaltiesReceivableAccountId"), //
         INTEREST_RECEIVABLE("interestReceivableAccountId"), //
         FEES_RECEIVABLE("feesReceivableAccountId"), //
-        INTEREST_PAYABLE("interestPayableAccountId");
+        INTEREST_PAYABLE("interestPayableAccountId"), //
+        ROUNDING_ADJUSTMENT("roundingAdjustmentAccountId");
 
         private final String value;
 
@@ -410,7 +421,8 @@ public final class AccountingConstants {
         FEES_RECEIVABLE("feeReceivableAccount"), //
         PENALTIES_RECEIVABLE("penaltyReceivableAccount"), //
         INTEREST_PAYABLE("interestPayableAccount"), //
-        INTEREST_RECEIVABLE("interestReceivableAccount"); //
+        INTEREST_RECEIVABLE("interestReceivableAccount"), //
+        ROUNDING_ADJUSTMENT("roundingAdjustmentAccount"); //
 
         private final String value;
 
@@ -439,7 +451,32 @@ public final class AccountingConstants {
         PAYABLE_DIVIDENDS(201, "payableDividends", GLAccountType.LIABILITY), //
         DIVIDEND_PAID(202, "dividendPaid", GLAccountType.LIABILITY), //
         RESERVE_FOR_DIVIDEND(301, "reserveForDividend", GLAccountType.EQUITY), //
-        DIVIDEND_FORFEITED_INCOME(400, "dividendForfeitedIncome", GLAccountType.INCOME); //
+        DIVIDEND_FORFEITED_INCOME(400, "dividendForfeitedIncome", GLAccountType.INCOME), //
+        /**
+         * The year's closed-out profit a dividend is declared against.
+         *
+         * Kept apart from {@link #RETAINED_PROFIT} on purpose: a declaration is sized on this balance, so anything that
+         * has already been through a distribution decision must not sit here, or the same money would be offered for
+         * distribution a second time.
+         */
+        DISTRIBUTABLE_PROFIT(302, "distributableProfit", GLAccountType.EQUITY), //
+        /**
+         * Where profit settles once it is no longer distributable - the remainder left after an approved declaration
+         * and dividends forfeited after the three-year claim window. Nothing here ever enters a later dividend
+         * calculation.
+         */
+        RETAINED_PROFIT(303, "retainedProfit", GLAccountType.EQUITY), //
+        /**
+         * Where the paise a dividend cannot divide evenly are collected.
+         *
+         * A declaration of 1,538.91 that allocates 1,538 to members leaves 0.91 that belongs to nobody. It used to be
+         * swept into retained profit along with the undistributed remainder, which buried an arithmetic artefact inside
+         * a figure the society reads as a real business result. Given its own account it stays separately readable -
+         * and an auditor asking why members received less than was declared can be answered from the ledger.
+         *
+         * Optional: a society that has not mapped it has the residue swept to retained profit exactly as before.
+         */
+        DIVIDEND_ROUND_OFF(304, "dividendRoundOff", GLAccountType.EQUITY); //
 
         private final Integer value;
         private final String code;

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java

@@ -137,7 +137,16 @@ public class CommandSourceService {
         String permission = commandSource.getPermissionCode();
         boolean isMakerChecker = configurationDomainService.isMakerCheckerEnabledForTask(permission);
         if (isMakerChecker || result.isRollbackTransaction()) {
-            if (isApprovedByChecker || isSuperUserBypassAllowed(commandSource, user)) {
+            // isApprovedByChecker is only ever true here for a genuine checker approval
+            // (PortfolioCommandSourceWritePlatformServiceImpl.approveEntry(), which has already run
+            // validateMakerCheckerTransaction() and confirmed the approver is not the maker) or a user
+            // editing their own account details (CommandWrapper.isChangeOfOwnUserDetails() - maker-checker
+            // genuinely does not apply there). On the ORIGINAL submission this is always false and `user`
+            // here is always the maker themselves, so there is deliberately no CHECKER_SUPER_USER (or any
+            // other) bypass at this point: holding CHECKER_SUPER_USER lets a user approve someone ELSE's
+            // request without needing the specific <TASK>_CHECKER permission, it must never let a maker
+            // auto-approve their own submission just by holding it.
+            if (isApprovedByChecker) {
                 commandSource.markAsChecked(user);
             } else {
                 if (commandSource.isSanitized()) {
@@ -151,25 +160,6 @@ public class CommandSourceService {
         return result;
     }
 
-    private boolean isSuperUserBypassAllowed(CommandSource commandSource, AppUser user) {
-        if (!user.isCheckerSuperUser()) {
-            return false;
-        }
-        if ("GLACCOUNT".equalsIgnoreCase(commandSource.getEntityName())
-                || "CBSBASEINTERESTRATE".equalsIgnoreCase(commandSource.getEntityName())
-                || "CHARGE".equalsIgnoreCase(commandSource.getEntityName())
-                || "LOANPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "SAVINGSPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "CURRENTPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "SHAREPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "FIXEDDEPOSITPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "USER".equalsIgnoreCase(commandSource.getEntityName())
-                || "ROLE".equalsIgnoreCase(commandSource.getEntityName())) {
-            return false;
-        }
-        return true;
-    }
-
     private void sanitizeJson(@NonNull CommandSource commandSource, Set<String> sanitizeKeys) {
         if (sanitizeKeys == null || sanitizeKeys.isEmpty()) {
             return;

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandWrapperBuilder.java

@@ -664,6 +664,14 @@ public class CommandWrapperBuilder {
         return this;
     }
 
+    public CommandWrapperBuilder deleteOffice(final Long officeId) {
+        this.actionName = "DELETE";
+        this.entityName = "OFFICE";
+        this.entityId = officeId;
+        this.href = "/offices/" + officeId;
+        return this;
+    }
+
     public CommandWrapperBuilder createOfficeTransaction() {
         this.actionName = "CREATE";
         this.entityName = "OFFICETRANSACTION";
@@ -748,6 +756,14 @@ public class CommandWrapperBuilder {
         return this;
     }
 
+    public CommandWrapperBuilder deleteFund(final Long fundId) {
+        this.actionName = "DELETE";
+        this.entityName = "FUND";
+        this.entityId = fundId;
+        this.href = "/funds/" + fundId;
+        return this;
+    }
+
     public CommandWrapperBuilder createReport() {
         this.actionName = "CREATE";
         this.entityName = "REPORT";
@@ -876,6 +892,70 @@ public class CommandWrapperBuilder {
         return this;
     }
 
+    public CommandWrapperBuilder createPaymentType() {
+        this.actionName = "CREATE";
+        this.entityName = "PAYMENTTYPE";
+        this.entityId = null;
+        this.href = "/paymenttypes/template";
+        return this;
+    }
+
+    public CommandWrapperBuilder updatePaymentType(final Long paymentTypeId) {
+        this.actionName = "UPDATE";
+        this.entityName = "PAYMENTTYPE";
+        this.entityId = paymentTypeId;
+        this.href = "/paymenttypes/" + paymentTypeId;
+        return this;
+    }
+
+    public CommandWrapperBuilder deletePaymentType(final Long paymentTypeId) {
+        this.actionName = "DELETE";
+        this.entityName = "PAYMENTTYPE";
+        this.entityId = paymentTypeId;
+        this.href = "/paymenttypes/" + paymentTypeId;
+        return this;
+    }
+
+    public CommandWrapperBuilder createSponsorBank() {
+        this.actionName = "CREATE";
+        this.entityName = "SPONSORBANK";
+        this.entityId = null;
+        this.href = "/sponsorbanks";
+        return this;
+    }
+
+    public CommandWrapperBuilder updateSponsorBank(final Long sponsorBankId) {
+        this.actionName = "UPDATE";
+        this.entityName = "SPONSORBANK";
+        this.entityId = sponsorBankId;
+        this.href = "/sponsorbanks/" + sponsorBankId;
+        return this;
+    }
+
+    public CommandWrapperBuilder updateSponsorDdGlMapping() {
+        this.actionName = "UPDATE";
+        this.entityName = "SPONSORDDGLMAPPING";
+        this.entityId = null;
+        this.href = "/sponsordd/gl-mapping";
+        return this;
+    }
+
+    public CommandWrapperBuilder updateInstitutionProfile() {
+        this.actionName = "UPDATE";
+        this.entityName = "INSTITUTIONPROFILE";
+        this.entityId = null;
+        this.href = "/institutionprofile";
+        return this;
+    }
+
+    public CommandWrapperBuilder updateBranchProfile(final Long officeId) {
+        this.actionName = "UPDATE";
+        this.entityName = "BRANCHPROFILE";
+        this.entityId = officeId;
+        this.href = "/branchprofile/" + officeId;
+        return this;
+    }
+
     public CommandWrapperBuilder createLoanProduct() {
         this.actionName = "CREATE";
         this.entityName = "LOANPRODUCT";
@@ -3382,6 +3462,13 @@ public class CommandWrapperBuilder {
         return this;
     }
 
+    public CommandWrapperBuilder updateCurrency() {
+        this.actionName = "UPDATE";
+        this.entityName = "CURRENCY";
+        this.href = "/currencies";
+        return this;
+    }
+
     public CommandWrapperBuilder updateExternalServiceProperties(final String externalServiceName) {
         this.actionName = "UPDATE";
         this.entityName = "EXTERNALSERVICES";
@@ -4722,4 +4809,36 @@ public class CommandWrapperBuilder {
         this.href = "/loans/" + loanId + "/originators/" + originatorId;
         return this;
     }
+
+    public CommandWrapperBuilder createSurvey() {
+        this.actionName = "CREATE";
+        this.entityName = "SURVEY";
+        this.entityId = null;
+        this.href = "/surveys";
+        return this;
+    }
+
+    public CommandWrapperBuilder updateSurvey(final Long surveyId) {
+        this.actionName = "UPDATE";
+        this.entityName = "SURVEY";
+        this.entityId = surveyId;
+        this.href = "/surveys/" + surveyId;
+        return this;
+    }
+
+    public CommandWrapperBuilder activateSurvey(final Long surveyId) {
+        this.actionName = "ACTIVATE";
+        this.entityName = "SURVEY";
+        this.entityId = surveyId;
+        this.href = "/surveys/" + surveyId;
+        return this;
+    }
+
+    public CommandWrapperBuilder deactivateSurvey(final Long surveyId) {
+        this.actionName = "DEACTIVATE";
+        this.entityName = "SURVEY";
+        this.entityId = surveyId;
+        this.href = "/surveys/" + surveyId;
+        return this;
+    }
 }

fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java

@@ -48,6 +48,12 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
     private final FromJsonHelper fromApiJsonHelper;
     private final CommandProcessingService processAndLogCommandService;
     private final SchedulerJobRunnerReadService schedulerJobRunnerReadService;
+    // No longer consulted by validateMakerCheckerTransaction() below: the maker-identity rule (a user
+    // can never approve their own submission) is now unconditional and isSameMakerCheckerEnabled() no
+    // longer overrides it. Left injected rather than removed - enable-same-maker-checker is still a
+    // live, independently-configurable global switch (System -> Configurations); deleting this field,
+    // and by extension deciding that switch should stop existing altogether, is a separate decision
+    // from closing this specific self-approval loophole.
     private final ConfigurationDomainService configurationService;
 
     @Override
@@ -123,14 +129,20 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
         AppUser appUser = this.context.authenticatedUser();
         String permissionCode = commandSource.getPermissionCode();
         appUser.validateHasCheckerPermissionTo(permissionCode);
-        if (!configurationService.isSameMakerCheckerEnabled() && !appUser.isCheckerSuperUser()) {
+        // Maker-identity rule: the user who submitted a command may never be the one who approves
-            AppUser maker = commandSource.getMaker();
+        // (or rejects) it - this is a fixed platform rule, not overridable by CHECKER_SUPER_USER (that
-            if (maker == null) {
+        // permission still lets its holder action a DIFFERENT user's request without needing the
-                throw new UnsupportedCommandException(permissionCode, "Maker user is missing.");
+        // specific <TASK>_CHECKER permission - see validateHasCheckerPermissionTo() above - it just no
-            }
+        // longer lets them action their own) and not overridable by the enable-same-maker-checker
-            if (Objects.equals(appUser.getId(), maker.getId())) {
+        // global switch (isSameMakerCheckerEnabled() is deliberately no longer consulted here; that
-                throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user.");
+        // configuration is left in place and unused for this decision rather than removed, since
-            }
+        // deleting a still-configurable global setting is a separate decision from this one).
+        AppUser maker = commandSource.getMaker();
+        if (maker == null) {
+            throw new UnsupportedCommandException(permissionCode, "Maker user is missing.");
+        }
+        if (Objects.equals(appUser.getId(), maker.getId())) {
+            throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user.");
         }
         return commandSource;
     }

fineract-core/src/main/java/org/apache/fineract/infrastructure/jobs/service/JobName.java

@@ -56,6 +56,7 @@ public enum JobName {
     EXECUTE_DIRTY_JOBS("Execute All Dirty Jobs"), //
     INCREASE_BUSINESS_DATE_BY_1_DAY("Increase Business Date by 1 day"), //
     INCREASE_COB_DATE_BY_1_DAY("Increase COB Date by 1 day"), //
+    SYNC_BUSINESS_DATE_TO_SYSTEM_DATE("Sync Business Date To System Date"), //
     LOAN_COB("Loan COB"), //
     LOAN_DELINQUENCY_CLASSIFICATION("Loan Delinquency Classification"), //
     SEND_ASYNCHRONOUS_EVENTS("Send Asynchronous Events"), //
@@ -71,6 +72,8 @@ public enum JobName {
     OUTWARD_CLEARING_BATCH_SEND("CTS Outward Clearing Batch Send"), //
     CTR_REPORT_GENERATION("AML Monthly CTR Report Generation"), //
     AML_STR_WEEKLY_DIGEST("AML STR Weekly Digest"), //
+    CLIENT_BEHAVIOUR_WINDOW("Client Behaviour Window Computation"), //
+    SAVE_RBI_FORM_A_RETURN("Save RBI Form A Return"), //
     ; //
 
     private final String name;

fineract-core/src/main/java/org/apache/fineract/organisation/monetary/api/CurrenciesApiResource.java

@@ -27,13 +27,14 @@ import jakarta.ws.rs.PUT;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
-import java.util.function.Supplier;
 import lombok.RequiredArgsConstructor;
-import org.apache.fineract.command.core.CommandPipeline;
+import org.apache.fineract.commands.domain.CommandWrapper;
-import org.apache.fineract.organisation.monetary.command.CurrencyUpdateCommand;
+import org.apache.fineract.commands.service.CommandWrapperBuilder;
+import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformService;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
 import org.apache.fineract.organisation.monetary.data.CurrencyConfigurationData;
 import org.apache.fineract.organisation.monetary.data.CurrencyUpdateRequest;
-import org.apache.fineract.organisation.monetary.data.CurrencyUpdateResponse;
 import org.apache.fineract.organisation.monetary.service.OrganisationCurrencyReadPlatformService;
 import org.springframework.stereotype.Component;
 
@@ -44,7 +45,8 @@ import org.springframework.stereotype.Component;
 public class CurrenciesApiResource {
 
     private final OrganisationCurrencyReadPlatformService readPlatformService;
-    private final CommandPipeline commandPipeline;
+    private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
+    private final DefaultToApiJsonSerializer<CurrencyUpdateRequest> toApiJsonSerializer;
 
     @GET
     @Consumes({ MediaType.APPLICATION_JSON })
@@ -65,13 +67,12 @@ public class CurrenciesApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     @Operation(summary = "Update Currency Configuration", description = "Updates the list of currencies permitted for use.")
-    public CurrencyUpdateResponse updateCurrencies(@Valid CurrencyUpdateRequest request) {
+    public String updateCurrencies(@Valid final CurrencyUpdateRequest request) {
-        final var command = new CurrencyUpdateCommand();
+        final CommandWrapper commandRequest = new CommandWrapperBuilder().updateCurrency()
+                .withJson(toApiJsonSerializer.serialize(request)).build();
 
-        command.setPayload(request);
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
 
-        final Supplier<CurrencyUpdateResponse> response = commandPipeline.send(command);
+        return toApiJsonSerializer.serialize(result);
-
-        return response.get();
     }
 }

fineract-core/src/main/java/org/apache/fineract/organisation/monetary/handler/UpdateCurrencyCommandHandler.java

@@ -0,0 +1,63 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.organisation.monetary.handler;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+import org.apache.fineract.commands.annotation.CommandType;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
+import org.apache.fineract.organisation.monetary.data.CurrencyUpdateRequest;
+import org.apache.fineract.organisation.monetary.data.CurrencyUpdateResponse;
+import org.apache.fineract.organisation.monetary.service.CurrencyWritePlatformService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@CommandType(entity = "CURRENCY", action = "UPDATE")
+public class UpdateCurrencyCommandHandler implements NewCommandSourceHandler {
+
+    private final CurrencyWritePlatformService writePlatformService;
+
+    @Autowired
+    public UpdateCurrencyCommandHandler(final CurrencyWritePlatformService writePlatformService) {
+        this.writePlatformService = writePlatformService;
+    }
+
+    @Transactional
+    @Override
+    public CommandProcessingResult processCommand(final JsonCommand command) {
+
+        final String[] currencyCodes = command.arrayValueOfParameterNamed("currencies");
+        final List<String> currencies = currencyCodes == null ? List.of() : Arrays.asList(currencyCodes);
+
+        final CurrencyUpdateRequest request = CurrencyUpdateRequest.builder().currencies(currencies).build();
+
+        final CurrencyUpdateResponse response = this.writePlatformService.updateAllowedCurrencies(request);
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .with(Map.of("currencies", response.getCurrencies())) //
+                .build();
+    }
+}

fineract-core/src/main/java/org/apache/fineract/organisation/office/domain/OfficeRepositoryWrapper.java

@@ -61,4 +61,15 @@ public class OfficeRepositoryWrapper {
     public void delete(final Office entity) {
         this.repository.delete(entity);
     }
+
+    /**
+     * Deletes and flushes in the same call, so a foreign-key violation the caller did not already check
+     * for (a savings transaction, a GL journal entry, a teller position -- anything on m_office's long
+     * tail of referencing tables) surfaces synchronously here, inside the caller's own try/catch, rather
+     * than at transaction-commit time where it can no longer be turned into a clean error message.
+     */
+    public void deleteAndFlush(final Office entity) {
+        this.repository.delete(entity);
+        this.repository.flush();
+    }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/PortfolioProductType.java

@@ -24,7 +24,10 @@ public enum PortfolioProductType {
     SAVING(2, "productType.saving"), //
     CLIENT(5, "productType.client"), //
     PROVISIONING(3, "productType.provisioning"), //
-    SHARES(4, "productType.shares"); //
+    SHARES(4, "productType.shares"), //
+    // Current products map their GLs under their own type: sharing SAVING with savings products let a savings
+    // product and a current product with the same id read each other's GL rows.
+    CURRENT(6, "productType.current"); //
 
     private final Integer value;
     private final String code;
@@ -52,17 +55,25 @@ public enum PortfolioProductType {
             return null;
         }
 
+        // Matched against each constant's own declared value above, not its declaration position --
+        // those two orderings diverge (CLIENT is declared 3rd but its value is 5), so a switch written
+        // by position silently mapped every id past SAVING to the wrong type: 3 (really PROVISIONING)
+        // returned CLIENT, 4 (really SHARES) returned PROVISIONING, 5 (really CLIENT) returned SHARES,
+        // and 6 (CURRENT) fell through to null -- a live NPE the moment a Current-product GL entry
+        // (entity_type_enum=6) reached this on the Journal Entries screen.
         switch (v) {
             case 1:
                 return LOAN;
             case 2:
                 return SAVING;
             case 3:
-                return CLIENT;
-            case 4:
                 return PROVISIONING;
-            case 5:
+            case 4:
                 return SHARES;
+            case 5:
+                return CLIENT;
+            case 6:
+                return CURRENT;
             default:
                 return null;
         }

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlert.java

@@ -78,6 +78,30 @@ public class AmlAlert extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     @Column(name = "disposition", length = 20)
     private String disposition;
 
+    /**
+     * The other rules this same transaction matched, comma-separated.
+     *
+     * <p>
+     * One transaction raises one alert, under the rule that most warrants attention - otherwise a
+     * single deposit arrives as several alerts and an officer has to dispose of each, with nothing
+     * stopping them clearing one while escalating another. The rules that did not win are kept here
+     * so the case file still shows everything that fired.
+     */
+    @Column(name = "also_matched_rules", length = 500)
+    private String alsoMatchedRules;
+
+    /**
+     * The worst severity band across every rule this transaction matched — 1 Low, 2 Medium, 3 High.
+     *
+     * <p>
+     * Not the same as the governing rule's own severity. A statutory CTR outranks everything when
+     * the alert is raised, so a high-severity rule can end up recorded in {@link #alsoMatchedRules}
+     * and vanish from the screen. An officer disposing of low and medium alerts in a batch would
+     * then be handed a transaction that had tripped a high-severity rule with nothing to show it.
+     */
+    @Column(name = "highest_severity")
+    private Integer highestSeverity;
+
     protected AmlAlert() {}
 
     public static AmlAlert raise(AmlTransactionType transactionType, Long transactionId, Client client, AmlTransactionRule rule,
@@ -94,6 +118,58 @@ public class AmlAlert extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         return alert;
     }
 
+    public String getAlsoMatchedRules() {
+        return this.alsoMatchedRules;
+    }
+
+    public Integer getHighestSeverity() {
+        return this.highestSeverity;
+    }
+
+    public void recordHighestSeverity(final Integer severity) {
+        this.highestSeverity = severity;
+    }
+
+    /** Truncated to the column width: the record is a convenience, never a reason to fail a save. */
+    public void recordAlsoMatchedRules(final String ruleCodes) {
+        this.alsoMatchedRules = ruleCodes == null || ruleCodes.isBlank() ? null
+                : (ruleCodes.length() > 500 ? ruleCodes.substring(0, 500) : ruleCodes);
+    }
+
+    /**
+     * Whether this alert is being worked by somebody other than the given officer.
+     *
+     * <p>
+     * An alert under review belongs to whoever opened it until they decide it or hand it back. A second officer
+     * reading the same case and reaching their own verdict is the failure this exists to prevent: the transaction
+     * would carry two reviews, and whichever was written last would be the one on file.
+     */
+    public boolean isHeldByAnother(final AppUser officer) {
+        return AmlAlertStatus.UNDER_REVIEW.name().equals(this.status) && this.reviewedBy != null && officer != null
+                && !this.reviewedBy.getId().equals(officer.getId());
+    }
+
+    /**
+     * Brings the alert into line with the Principal Officer's conclusion on the case it opened.
+     *
+     * <p>
+     * An escalation is a referral, not a verdict: it says the AML Officer wanted the case looked at. The verdict is
+     * the Principal Officer's, and when they conclude the case clear the alert has to say so too. Left as ESCALATED,
+     * the feed would go on showing a transaction as suspicious after the bank had decided it was not - and the officer
+     * who cleared it would have no way to see their own conclusion reflected where the alert is worked.
+     *
+     * <p>
+     * Distinct from {@link #whitelist}: this does not pass the alert's own immutability guard, because it is not a
+     * second officer overturning a decision. It is the case this alert was referred into, coming back with its answer.
+     */
+    public void applyStrConclusion(final boolean suspicious, final AppUser principalOfficer, final String notes) {
+        this.reviewedBy = principalOfficer;
+        this.reviewedOn = LocalDateTime.now();
+        this.reviewNotes = notes;
+        this.disposition = (suspicious ? AmlAlertDisposition.ESCALATE : AmlAlertDisposition.WHITELIST).name();
+        this.status = (suspicious ? AmlAlertStatus.ESCALATED : AmlAlertStatus.WHITELISTED).name();
+    }
+
     public void whitelist(AppUser reviewer, String notes) {
         this.reviewedBy = reviewer;
         this.reviewedOn = LocalDateTime.now();

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlertRepository.java

@@ -44,4 +44,18 @@ public interface AmlAlertRepository extends JpaRepository<AmlAlert, Long> {
      * twice, which would put two STR cases in front of the Principal Officer for a single transaction.
      */
     List<AmlAlert> findByRule_IdAndTransactionId(Long ruleId, Long transactionId);
+
+    /**
+     * A customer's still-open alerts inside the observation window, oldest first.
+     *
+     * <p>
+     * What a recurring-behaviour review acts on. Open is defined as not yet decided rather than by naming the statuses
+     * that are open, so a status this query does not know about is still treated as work: an alert wrongly included
+     * costs a reviewer a glance, one wrongly excluded is a pattern the bank never looked at. A decision about the
+     * customer's pattern must not reopen alerts an officer has already disposed of individually - and oldest first so
+     * that a partial failure leaves the longest-standing ones dealt with.
+     */
+    @Query("SELECT a FROM AmlAlert a WHERE a.client.id = :clientId AND a.raisedOn >= :since "
+            + "AND a.status NOT IN ('WHITELISTED', 'ESCALATED') ORDER BY a.raisedOn ASC")
+    List<AmlAlert> findOpenAlertsForClientSince(@Param("clientId") Long clientId, @Param("since") LocalDateTime since);
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlertRule.java

@@ -0,0 +1,163 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.time.LocalDateTime;
+import org.apache.fineract.useradministration.domain.AppUser;
+
+/**
+ * One rule a transaction matched, and what the officer decided about that rule.
+ *
+ * <p>
+ * The alert is the case; this is a finding within it. A single deposit can trip six rules where five are explained by
+ * the customer's declared business and the sixth is not - one verdict over the whole alert either loses that sixth
+ * observation or sends the other five to an STR they do not belong in.
+ *
+ * <p>
+ * The rule is held by code rather than by a foreign key to {@link AmlTransactionRule}, and the severity is copied in
+ * rather than read back through it. An alert records what was detected at the time; re-banding or retiring a rule
+ * afterwards must not rewrite what the officer was looking at when they decided.
+ */
+@Entity
+@Table(name = "m_aml_alert_rule")
+public class AmlAlertRule {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne
+    @JoinColumn(name = "alert_id", nullable = false)
+    private AmlAlert alert;
+
+    @Column(name = "rule_code", nullable = false, length = 100)
+    private String ruleCode;
+
+    @Column(name = "risk_category")
+    private Integer riskCategory;
+
+    @Column(name = "is_governing", nullable = false)
+    private boolean governing;
+
+    @Column(name = "disposition", length = 20)
+    private String disposition;
+
+    @ManyToOne
+    @JoinColumn(name = "reviewed_by")
+    private AppUser reviewedBy;
+
+    @Column(name = "reviewed_on")
+    private LocalDateTime reviewedOn;
+
+    @Column(name = "review_notes", length = 1000)
+    private String reviewNotes;
+
+    /**
+     * Whether the officer named this rule, as against it being closed to keep the case consistent.
+     *
+     * <p>
+     * Marking one rule suspicious escalates the transaction and closes every other rule under the same escalation -
+     * nothing may stay open behind a filed STR. Without this the record would read as though all of them had been
+     * examined and condemned, and on a transaction that tripped six rules, which one the officer put their name to is
+     * the substance of the finding.
+     */
+    @Column(name = "directly_decided", nullable = false)
+    private boolean directlyDecided;
+
+    protected AmlAlertRule() {}
+
+    public static AmlAlertRule of(final AmlAlert alert, final String ruleCode, final Integer riskCategory,
+            final boolean governing) {
+        final AmlAlertRule finding = new AmlAlertRule();
+        finding.alert = alert;
+        finding.ruleCode = ruleCode;
+        finding.riskCategory = riskCategory;
+        finding.governing = governing;
+        return finding;
+    }
+
+    /**
+     * @param directlyDecided
+     *            true when the officer named this rule; false when it was closed alongside one they named
+     */
+    public void decide(final AmlAlertDisposition disposition, final AppUser reviewer, final String notes,
+            final boolean directlyDecided) {
+        this.disposition = disposition.name();
+        this.reviewedBy = reviewer;
+        this.reviewedOn = LocalDateTime.now();
+        this.reviewNotes = notes;
+        this.directlyDecided = directlyDecided;
+    }
+
+    public boolean isDirectlyDecided() {
+        return this.directlyDecided;
+    }
+
+    public boolean isDecided() {
+        return this.disposition != null;
+    }
+
+    public boolean isEscalated() {
+        return AmlAlertDisposition.ESCALATE.name().equals(this.disposition);
+    }
+
+    public Long getId() {
+        return this.id;
+    }
+
+    public AmlAlert getAlert() {
+        return this.alert;
+    }
+
+    public String getRuleCode() {
+        return this.ruleCode;
+    }
+
+    public Integer getRiskCategory() {
+        return this.riskCategory;
+    }
+
+    public boolean isGoverning() {
+        return this.governing;
+    }
+
+    public String getDisposition() {
+        return this.disposition;
+    }
+
+    public AppUser getReviewedBy() {
+        return this.reviewedBy;
+    }
+
+    public LocalDateTime getReviewedOn() {
+        return this.reviewedOn;
+    }
+
+    public String getReviewNotes() {
+        return this.reviewNotes;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlAlertRuleRepository.java

@@ -0,0 +1,31 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.util.Collection;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface AmlAlertRuleRepository extends JpaRepository<AmlAlertRule, Long> {
+
+    List<AmlAlertRule> findByAlertId(Long alertId);
+
+    /** Every finding across a page of alerts, in one read rather than one query per alert. */
+    List<AmlAlertRule> findByAlertIdIn(Collection<Long> alertIds);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlRecurringEscalationTier.java

@@ -0,0 +1,106 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+/**
+ * How far a customer's repetition has gone, and what the bank's answer to it has to be.
+ *
+ * <p>
+ * A customer who surfaces once is a question; one who surfaces for the fortieth time is an answer the bank has not
+ * acted on. Without a ladder every review looked the same - same screen, same three buttons, same outcome - so the
+ * fortieth review cost an officer the same effort as the first and changed as little.
+ *
+ * <p>
+ * Each tier does two things: it sets how long a review holds the customer out of the queue, and it says what the
+ * reviewer is expected to do. The windows shorten as the tier rises, because a customer the bank is more worried
+ * about should come back sooner, not later.
+ */
+public enum AmlRecurringEscalationTier {
+
+    /** Ordinary repetition. A review stands for a quarter unless the count climbs into the next tier. */
+    ROUTINE(0, 90),
+
+    /**
+     * Enough repetition that the customer's risk rating is no longer just a KYC-time judgement. Reviewed monthly, and
+     * the reviewer is asked to consider whether the rating still fits.
+     */
+    ELEVATED(7, 30),
+
+    /**
+     * Beyond what a branch officer should be closing on their own. Reviewed fortnightly, and the review is expected
+     * to be taken by someone senior.
+     */
+    SENIOR(15, 14),
+
+    /**
+     * Repetition at a level that is itself the suspicion. An STR is the expected outcome, and clearing at this tier
+     * is a decision that has to be defensible on its own - so the review stands for a week only.
+     */
+    MANDATORY_STR(30, 7);
+
+    private final int minimumAlertCount;
+    private final int reviewValidityDays;
+
+    AmlRecurringEscalationTier(final int minimumAlertCount, final int reviewValidityDays) {
+        this.minimumAlertCount = minimumAlertCount;
+        this.reviewValidityDays = reviewValidityDays;
+    }
+
+    /** The tier a customer sitting on this many alerts falls into. */
+    public static AmlRecurringEscalationTier forAlertCount(final int alertCount) {
+        AmlRecurringEscalationTier tier = ROUTINE;
+        for (final AmlRecurringEscalationTier candidate : values()) {
+            if (alertCount >= candidate.minimumAlertCount) {
+                tier = candidate;
+            }
+        }
+        return tier;
+    }
+
+    public int getMinimumAlertCount() {
+        return minimumAlertCount;
+    }
+
+    public int getReviewValidityDays() {
+        return reviewValidityDays;
+    }
+
+    /**
+     * How far the alert count may climb before a standing review is set aside and the customer returns early.
+     *
+     * <p>
+     * A validity window alone would hold a customer out while their behaviour changed underneath it: reviewed at four
+     * alerts and then trips forty more the same week, the review would still stand for the full quarter. Allowing the
+     * count to grow by the tier's own span before forcing a return keeps ordinary repetition quiet while letting a
+     * genuine change in behaviour break through. Tighter at the higher tiers, where less change should be tolerated.
+     */
+    public int alertGrowthBeforeEarlyReturn() {
+        return switch (this) {
+            case ROUTINE -> 5;
+            case ELEVATED -> 4;
+            case SENIOR -> 3;
+            case MANDATORY_STR -> 2;
+        };
+    }
+
+    /** Whether a review at this tier is expected to raise an STR rather than close the customer off. */
+    public boolean expectsStr() {
+        return this == MANDATORY_STR;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlRecurringReview.java

@@ -26,6 +26,7 @@ import jakarta.persistence.Id;
 import jakarta.persistence.JoinColumn;
 import jakarta.persistence.ManyToOne;
 import jakarta.persistence.Table;
+import java.time.LocalDate;
 import java.time.LocalDateTime;
 import org.apache.fineract.portfolio.client.domain.Client;
 import org.apache.fineract.useradministration.domain.AppUser;
@@ -65,6 +66,20 @@ public class AmlRecurringReview {
     @Column(name = "reviewed_on", nullable = false)
     private LocalDateTime reviewedOn;
 
+    /**
+     * The date this review stops standing. Null on reviews taken before validity existed, which keep the older
+     * behaviour of lapsing the moment one more alert lands.
+     */
+    @Column(name = "valid_until")
+    private LocalDate validUntil;
+
+    @Column(name = "escalation_tier", length = 20)
+    private String escalationTier;
+
+    /** How many of the customer's open alerts this review actually disposed of. */
+    @Column(name = "alerts_actioned")
+    private Integer alertsActioned;
+
     protected AmlRecurringReview() {}
 
     public static AmlRecurringReview record(final Client client, final int alertCountAtReview,
@@ -76,9 +91,22 @@ public class AmlRecurringReview {
         review.notes = notes;
         review.reviewedBy = reviewedBy;
         review.reviewedOn = LocalDateTime.now();
+
+        // The tier follows from the count, not from what the reviewer picked: how often a customer has surfaced is a
+        // fact about them, and letting the outcome set it would let a customer be held at ROUTINE indefinitely by
+        // always being cleared.
+        final AmlRecurringEscalationTier tier = AmlRecurringEscalationTier.forAlertCount(alertCountAtReview);
+        review.escalationTier = tier.name();
+        review.validUntil = LocalDate.now().plusDays(tier.getReviewValidityDays());
+        review.alertsActioned = 0;
         return review;
     }
 
+    /** Records how many open alerts the review disposed of, once the caller has acted on them. */
+    public void recordAlertsActioned(final int count) {
+        this.alertsActioned = count;
+    }
+
     public Long getId() {
         return id;
     }
@@ -106,4 +134,35 @@ public class AmlRecurringReview {
     public LocalDateTime getReviewedOn() {
         return reviewedOn;
     }
+
+    public LocalDate getValidUntil() {
+        return validUntil;
+    }
+
+    public AmlRecurringEscalationTier getEscalationTier() {
+        return escalationTier == null ? AmlRecurringEscalationTier.ROUTINE : AmlRecurringEscalationTier.valueOf(escalationTier);
+    }
+
+    public Integer getAlertsActioned() {
+        return alertsActioned;
+    }
+
+    /**
+     * Whether this review still holds the customer out of the review queue.
+     *
+     * <p>
+     * Two ways it stops standing. Its window runs out, or the customer's behaviour moves on far enough that the
+     * review no longer describes them - judged by how much the alert count has grown since, against the allowance for
+     * the tier it was taken at. A review with no window at all is a pre-existing one, and keeps the original rule of
+     * lapsing as soon as one more alert arrives.
+     */
+    public boolean stillStands(final int currentAlertCount) {
+        if (validUntil == null) {
+            return currentAlertCount <= alertCountAtReview;
+        }
+        if (LocalDate.now().isAfter(validUntil)) {
+            return false;
+        }
+        return currentAlertCount - alertCountAtReview < getEscalationTier().alertGrowthBeforeEarlyReturn();
+    }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrCaseAlert.java

@@ -0,0 +1,83 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+import java.time.LocalDateTime;
+
+/**
+ * One alert covered by an STR case.
+ *
+ * <p>
+ * A case escalated from a single transaction covers that one alert. A case raised off a customer's repeated behaviour
+ * covers all the alerts that make up the pattern - which is what an STR to FIU-IND actually describes, and what the
+ * Principal Officer has to be able to read in one place.
+ */
+@Entity
+@Table(name = "m_aml_str_case_alert")
+public class AmlStrCaseAlert {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne(optional = false)
+    @JoinColumn(name = "str_case_id", nullable = false)
+    private AmlStrCase strCase;
+
+    @ManyToOne(optional = false)
+    @JoinColumn(name = "alert_id", nullable = false)
+    private AmlAlert alert;
+
+    @Column(name = "added_on_utc", nullable = false)
+    private LocalDateTime addedOn;
+
+    protected AmlStrCaseAlert() {}
+
+    public static AmlStrCaseAlert link(final AmlStrCase strCase, final AmlAlert alert) {
+        final AmlStrCaseAlert link = new AmlStrCaseAlert();
+        link.strCase = strCase;
+        link.alert = alert;
+        link.addedOn = LocalDateTime.now();
+        return link;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public AmlStrCase getStrCase() {
+        return strCase;
+    }
+
+    public AmlAlert getAlert() {
+        return alert;
+    }
+
+    public LocalDateTime getAddedOn() {
+        return addedOn;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrCaseAlertRepository.java

@@ -0,0 +1,40 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.domain;
+
+import java.util.List;
+import java.util.Optional;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface AmlStrCaseAlertRepository extends JpaRepository<AmlStrCaseAlert, Long> {
+
+    /** The alerts one case covers, oldest first - the order the pattern happened in. */
+    List<AmlStrCaseAlert> findByStrCase_IdOrderByAlert_RaisedOnAsc(Long strCaseId);
+
+    /**
+     * The case already covering an alert, if any.
+     *
+     * <p>
+     * What stops a transaction reaching FIU-IND twice: an alert already inside a case is not attached to a second
+     * one, however it comes to be escalated again.
+     */
+    Optional<AmlStrCaseAlert> findByAlert_Id(Long alertId);
+
+    long countByStrCase_Id(Long strCaseId);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlStrCaseRepository.java

@@ -20,6 +20,7 @@ package org.apache.fineract.portfolio.aml.domain;
 
 import java.time.LocalDate;
 import java.util.List;
+import java.util.Optional;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
@@ -28,6 +29,9 @@ public interface AmlStrCaseRepository extends JpaRepository<AmlStrCase, Long> {
 
     long countByClient_Id(Long clientId);
 
+    /** The case already open for a transaction, so escalating it again does not open a second one. */
+    Optional<AmlStrCase> findByAlertId(Long alertId);
+
     List<AmlStrCase> findByStatus(String status);
 
     @Query("SELECT c FROM AmlStrCase c WHERE c.status = 'CONCLUDED_SUSPICIOUS' AND c.concludedOn BETWEEN :from AND :to")

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlTransactionRule.java

@@ -84,6 +84,49 @@ public class AmlTransactionRule {
     @Column(name = "is_active", nullable = false)
     private boolean active;
 
+    /**
+     * CREDIT or DEBIT for a rule written about one direction only; null where either way qualifies.
+     * A rule named for withdrawals must not fire on a deposit.
+     */
+    @Column(name = "direction", length = 10)
+    private String direction;
+
+    /** True where only physical cash qualifies — a cash-reporting rule is not about transfers. */
+    @Column(name = "cash_only", nullable = false)
+    private boolean cashOnly;
+
+    /**
+     * How many transactions must make up the window before a pattern rule fires. Structuring is
+     * many small transactions; without this floor a single large one satisfies the window total and
+     * reads as a pattern it is not.
+     */
+    @Column(name = "min_transaction_count")
+    private Integer minTransactionCount;
+
+    /**
+     * Which customers a rule is about, where the rule is about the customer rather than the
+     * transaction: PEP, CHARITABLE_ORG, HIGH_RISK_BUSINESS, NEW_ACCOUNT. Null means the rule is
+     * about the transaction alone and so applies to everyone.
+     */
+    @Column(name = "subject_scope", length = 30)
+    private String subjectScope;
+
+    public String getSubjectScope() {
+        return subjectScope;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public boolean isCashOnly() {
+        return cashOnly;
+    }
+
+    public Integer getMinTransactionCount() {
+        return minTransactionCount;
+    }
+
     protected AmlTransactionRule() {}
 
     /**

fineract-core/src/main/java/org/apache/fineract/portfolio/aml/domain/AmlTransactionRuleRepository.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.aml.domain;
 
+import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
 import org.springframework.data.jpa.repository.JpaRepository;
@@ -32,4 +33,10 @@ public interface AmlTransactionRuleRepository extends JpaRepository<AmlTransacti
      * by hand from the ledger.
      */
     Optional<AmlTransactionRule> findByRuleCode(String ruleCode);
+
+    /**
+     * Every rule named in the given codes, in one read. The alert screen resolves the rules each transaction matched
+     * into descriptions and severities; doing that a code at a time would be one query per rule per alert.
+     */
+    List<AmlTransactionRule> findByRuleCodeIn(Collection<String> ruleCodes);
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientBehaviourWindow.java

@@ -0,0 +1,219 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+/**
+ * What one customer's money actually did over a period, and what that says about their rating.
+ *
+ * <p>
+ * A risk rating describes behaviour, and behaviour is a period rather than an event. Judging it from the alert feed
+ * meant a customer appeared the moment one transaction tripped a rule and was recommended for re-rating on that alone
+ * - a single shop purchase could argue for lowering a High rating, and a single large deposit for raising a Low one.
+ * Neither is a pattern.
+ *
+ * <p>
+ * One row is one window for one customer, computed nightly. Upgrades and downgrades read different windows, because
+ * the questions are not symmetric: a concern is about what the customer is doing now, and confidence needs a year of
+ * it. The suggestion is stored with the figures it was drawn from, so an officer reviewing it months later sees what
+ * the system was looking at rather than a conclusion with no working.
+ */
+@Entity
+@Table(name = "m_client_behaviour_window")
+public class ClientBehaviourWindow {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "client_id", nullable = false)
+    private Long clientId;
+
+    @Column(name = "window_from", nullable = false)
+    private LocalDate windowFrom;
+
+    @Column(name = "window_to", nullable = false)
+    private LocalDate windowTo;
+
+    @Column(name = "txn_count")
+    private Integer txnCount;
+
+    @Column(name = "distinct_months")
+    private Integer distinctMonths;
+
+    @Column(name = "credit_total", precision = 19, scale = 6)
+    private BigDecimal creditTotal;
+
+    @Column(name = "debit_total", precision = 19, scale = 6)
+    private BigDecimal debitTotal;
+
+    @Column(name = "largest_txn", precision = 19, scale = 6)
+    private BigDecimal largestTxn;
+
+    @Column(name = "cash_txn_count")
+    private Integer cashTxnCount;
+
+    @Column(name = "cash_total", precision = 19, scale = 6)
+    private BigDecimal cashTotal;
+
+    @Column(name = "large_txn_count")
+    private Integer largeTxnCount;
+
+    @Column(name = "declared_annual_income", precision = 19, scale = 6)
+    private BigDecimal declaredAnnualIncome;
+
+    @Column(name = "declared_annual_turnover", precision = 19, scale = 6)
+    private BigDecimal declaredAnnualTurnover;
+
+    @Column(name = "income_ratio", precision = 19, scale = 6)
+    private BigDecimal incomeRatio;
+
+    @Column(name = "alert_count")
+    private Integer alertCount;
+
+    @Column(name = "str_case_count")
+    private Integer strCaseCount;
+
+    @Column(name = "risk_category_at_review")
+    private Integer riskCategoryAtReview;
+
+    /** UP, DOWN or HOLD. */
+    @Column(name = "suggested_direction", length = 10)
+    private String suggestedDirection;
+
+    @Column(name = "suggested_category")
+    private Integer suggestedCategory;
+
+    @Column(name = "suggestion_reason", length = 500)
+    private String suggestionReason;
+
+    @Column(name = "computed_on")
+    private LocalDateTime computedOn;
+
+    protected ClientBehaviourWindow() {}
+
+    public static ClientBehaviourWindow of(final Long clientId, final LocalDate windowFrom, final LocalDate windowTo) {
+        final ClientBehaviourWindow window = new ClientBehaviourWindow();
+        window.clientId = clientId;
+        window.windowFrom = windowFrom;
+        window.windowTo = windowTo;
+        window.computedOn = LocalDateTime.now();
+        return window;
+    }
+
+    public void recordDistinctMonths(final Integer months) {
+        this.distinctMonths = months;
+    }
+
+    public Integer getDistinctMonths() {
+        return this.distinctMonths;
+    }
+
+    public void recordActivity(final Integer txnCount, final BigDecimal creditTotal, final BigDecimal debitTotal,
+            final BigDecimal largestTxn, final Integer cashTxnCount, final BigDecimal cashTotal, final Integer largeTxnCount) {
+        this.txnCount = txnCount;
+        this.creditTotal = creditTotal;
+        this.debitTotal = debitTotal;
+        this.largestTxn = largestTxn;
+        this.cashTxnCount = cashTxnCount;
+        this.cashTotal = cashTotal;
+        this.largeTxnCount = largeTxnCount;
+    }
+
+    public void recordMonitoring(final Integer alertCount, final Integer strCaseCount, final Integer riskCategoryAtReview) {
+        this.alertCount = alertCount;
+        this.strCaseCount = strCaseCount;
+        this.riskCategoryAtReview = riskCategoryAtReview;
+    }
+
+    /**
+     * Turnover measured against what the customer said to expect.
+     *
+     * <p>
+     * Null rather than zero when no income was declared: the ratio is unknown, not nil, and a rule that treats an
+     * unknown as a benign zero would clear every customer the bank never asked.
+     */
+    public void recordDeclared(final BigDecimal income, final BigDecimal turnover, final BigDecimal periodTurnover) {
+        this.declaredAnnualIncome = income;
+        this.declaredAnnualTurnover = turnover;
+        final BigDecimal basis = income != null && income.signum() > 0 ? income
+                : (turnover != null && turnover.signum() > 0 ? turnover : null);
+        this.incomeRatio = basis == null || periodTurnover == null ? null
+                : periodTurnover.divide(basis, 6, java.math.RoundingMode.HALF_UP);
+    }
+
+    public void recordSuggestion(final String direction, final Integer category, final String reason) {
+        this.suggestedDirection = direction;
+        this.suggestedCategory = category;
+        this.suggestionReason = reason == null || reason.length() <= 500 ? reason : reason.substring(0, 500);
+    }
+
+    public Long getClientId() {
+        return this.clientId;
+    }
+
+    public LocalDate getWindowFrom() {
+        return this.windowFrom;
+    }
+
+    public LocalDate getWindowTo() {
+        return this.windowTo;
+    }
+
+    public Integer getTxnCount() {
+        return this.txnCount;
+    }
+
+    public BigDecimal getCashTotal() {
+        return this.cashTotal;
+    }
+
+    public Integer getLargeTxnCount() {
+        return this.largeTxnCount;
+    }
+
+    public Integer getAlertCount() {
+        return this.alertCount;
+    }
+
+    public Integer getStrCaseCount() {
+        return this.strCaseCount;
+    }
+
+    public Integer getRiskCategoryAtReview() {
+        return this.riskCategoryAtReview;
+    }
+
+    public String getSuggestedDirection() {
+        return this.suggestedDirection;
+    }
+
+    public Integer getSuggestedCategory() {
+        return this.suggestedCategory;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientBehaviourWindowRepository.java

@@ -0,0 +1,43 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.domain;
+
+import java.time.LocalDate;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+public interface ClientBehaviourWindowRepository extends JpaRepository<ClientBehaviourWindow, Long> {
+
+    List<ClientBehaviourWindow> findByClientId(Long clientId);
+
+    /**
+     * Clears the windows computed for a given day before the job writes that day's.
+     *
+     * <p>
+     * The job is a recomputation, not an append. Re-running it - after a failure, or twice in a night - must leave one
+     * set of windows rather than a customer appearing several times on the review screen with slightly different
+     * figures.
+     */
+    @Modifying
+    @Query("DELETE FROM ClientBehaviourWindow w WHERE w.windowTo = :windowTo")
+    void deleteByWindowTo(@Param("windowTo") LocalDate windowTo);
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientKyc.java

@@ -291,6 +291,31 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     @Column(name = "form15_fy", length = 10)
     private String form15Fy;
 
+    // ── Risk profile ─────────────────────────────────────────────────────────
+    /**
+     * Customer facts the risk re-rating policy tests against, as against anything the customer transacted.
+     *
+     * <p>
+     * A politically exposed person is not downgraded because their activity looks ordinary — that is precisely the
+     * risk — and the same holds for a sanctions or adverse-media match. False means "not recorded as such", which is
+     * the correct reading for a book where nobody was ever asked; it is not an assertion that the customer is clean.
+     */
+    @Column(name = "is_pep", nullable = false)
+    private boolean isPep;
+
+    @Column(name = "sanctions_match", nullable = false)
+    private boolean sanctionsMatch;
+
+    @Column(name = "adverse_media_match", nullable = false)
+    private boolean adverseMediaMatch;
+
+    /** What the customer told the bank to expect, which their actual turnover is measured against. */
+    @Column(name = "declared_annual_income", precision = 19, scale = 6)
+    private BigDecimal declaredAnnualIncome;
+
+    @Column(name = "declared_annual_turnover", precision = 19, scale = 6)
+    private BigDecimal declaredAnnualTurnover;
+
     // ── CKYCRR ───────────────────────────────────────────────────────────────
     /** Central KYC Records Registry number issued by CERSAI */
     @Column(name = "ckyc_number", length = 14)
@@ -355,7 +380,7 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         this.dinVerified = false;
         this.isException = false;
         this.exceptionResolved = false;
-        this.initiatedOn = DateUtils.getLocalDateOfTenant();
+        this.initiatedOn = DateUtils.getBusinessLocalDate();
     }
 
     public static ClientKyc initiateKyc(final Client client, final JsonCommand command) {
@@ -527,6 +552,19 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
                 v -> this.aadhaarReceiptRemarks = v);
         updateDateField(command, "aadhaarReceiptTakenOn", this.aadhaarReceiptTakenOn, actualChanges,
                 v -> this.aadhaarReceiptTakenOn = v);
+        // Risk profile. These are determinations about the customer rather than about a transaction, and the
+        // re-rating policy reads them directly: a PEP or a sanctions match holds a rating at High however ordinary the
+        // period's activity looks.
+        updateBooleanField(command, "isPep", this.isPep, actualChanges, v -> this.isPep = v != null ? v : false);
+        updateBooleanField(command, "sanctionsMatch", this.sanctionsMatch, actualChanges,
+                v -> this.sanctionsMatch = v != null ? v : false);
+        updateBooleanField(command, "adverseMediaMatch", this.adverseMediaMatch, actualChanges,
+                v -> this.adverseMediaMatch = v != null ? v : false);
+        updateBigDecimalField(command, "declaredAnnualIncome", this.declaredAnnualIncome, actualChanges,
+                v -> this.declaredAnnualIncome = v);
+        updateBigDecimalField(command, "declaredAnnualTurnover", this.declaredAnnualTurnover, actualChanges,
+                v -> this.declaredAnnualTurnover = v);
+
         updateStringField(command, "enterprisePan", this.enterprisePan, actualChanges, v -> this.enterprisePan = v);
         updateStringField(command, "cinNumber", this.cinNumber, actualChanges, v -> this.cinNumber = v);
         updateStringField(command, "dinNumber", this.dinNumber, actualChanges, v -> this.dinNumber = v);
@@ -562,10 +600,21 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
                 v -> this.form15Applicable = v);
         updateStringField(command, "form15Type", this.form15Type, actualChanges, v -> this.form15Type = v);
         updateStringField(command, "form15FY", this.form15Fy, actualChanges, v -> this.form15Fy = v);
-        updateBooleanField(command, "isException", this.isException, actualChanges, v -> this.isException = v != null ? v : false);
+        // The four exception columns are derived from whether the identity checks have passed, not
-        updateStringField(command, "exceptionReason", this.exceptionReason, actualChanges, v -> this.exceptionReason = v);
+        // data an officer types, so they are updated without recording an overwrite. A verified
-        updateBooleanField(command, "exceptionResolved", this.exceptionResolved, actualChanges, v -> this.exceptionResolved = v != null ? v : false);
+        // record demands remarks for any field it already held (see
-        updateDateField(command, "exceptionResolvedOn", this.exceptionResolvedOn, actualChanges, v -> this.exceptionResolvedOn = v);
+        // getFieldsOverwrittenByLastUpdate), and is_exception is never null once written — so
+        // counting these would make closing a settled exception impossible without a justification
+        // for something nobody chose. That is what left clients verified on the KYC tab while the
+        // exceptions register still listed them as Pending.
+        updateDerivedBooleanField(command, "isException", this.isException, actualChanges,
+                v -> this.isException = v != null ? v : false);
+        updateDerivedStringField(command, "exceptionReason", this.exceptionReason, actualChanges,
+                v -> this.exceptionReason = v);
+        updateDerivedBooleanField(command, "exceptionResolved", this.exceptionResolved, actualChanges,
+                v -> this.exceptionResolved = v != null ? v : false);
+        updateDerivedDateField(command, "exceptionResolvedOn", this.exceptionResolvedOn, actualChanges,
+                v -> this.exceptionResolvedOn = v);
         updateBooleanField(command, "panVerified", this.panVerified, actualChanges, v -> this.panVerified = v != null ? v : false);
         updateBooleanField(command, "aadhaarVerified", this.aadhaarVerified, actualChanges, v -> this.aadhaarVerified = v != null ? v : false);
         updateBooleanField(command, "gstinVerified", this.gstinVerified, actualChanges, v -> this.gstinVerified = v != null ? v : false);
@@ -620,6 +669,44 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
      * populated is the record being completed rather than altered, so it is deliberately not
      * recorded — see {@link #getFieldsOverwrittenByLastUpdate()}.
      */
+    /*
+     * Derived-field variants of the update helpers above.
+     *
+     * Identical, minus the recordOverwrite call: these columns are computed from whether the
+     * identity checks have passed rather than entered by an officer, so replacing one is not the
+     * kind of change a verified record demands a justification for. They still report into
+     * `changes`, so the update is persisted and audited like any other.
+     */
+
+    private void updateDerivedBooleanField(final JsonCommand command, final String param, final Boolean current,
+            final Map<String, Object> changes, final java.util.function.Consumer<Boolean> setter) {
+        if (command.parameterExists(param)) {
+            final Boolean newValue = command.booleanObjectValueOfParameterNamed(param);
+            if ((newValue == null && current != null) || (newValue != null && !newValue.equals(current))) {
+                changes.put(param, newValue);
+                setter.accept(newValue);
+            }
+        }
+    }
+
+    private void updateDerivedStringField(final JsonCommand command, final String param, final String current,
+            final Map<String, Object> changes, final java.util.function.Consumer<String> setter) {
+        if (command.isChangeInStringParameterNamed(param, current)) {
+            final String newValue = command.stringValueOfParameterNamed(param);
+            changes.put(param, newValue);
+            setter.accept(StringUtils.defaultIfEmpty(newValue, null));
+        }
+    }
+
+    private void updateDerivedDateField(final JsonCommand command, final String param, final LocalDate current,
+            final Map<String, Object> changes, final java.util.function.Consumer<LocalDate> setter) {
+        if (command.isChangeInLocalDateParameterNamed(param, current)) {
+            final LocalDate newValue = command.localDateValueOfParameterNamed(param);
+            changes.put(param, newValue);
+            setter.accept(newValue);
+        }
+    }
+
     private void recordOverwrite(final String param, final Object currentValue) {
         final boolean wasPopulated = currentValue instanceof String text
                 ? StringUtils.isNotBlank(text)
@@ -670,13 +757,13 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
     public void markCkycUploaded(final String ckycNumber, final String batchId) {
         this.ckycNumber = StringUtils.defaultIfEmpty(ckycNumber, null);
         this.ckycBatchId = StringUtils.defaultIfEmpty(batchId, null);
-        this.ckycUploadedOn = DateUtils.getLocalDateOfTenant();
+        this.ckycUploadedOn = DateUtils.getBusinessLocalDate();
     }
 
     /** Called after successful 3rd-party verification of all required documents. */
     public void markVerified(final String ckycNumber) {
         this.kycStatus = ClientKycStatus.VERIFIED.getValue();
-        this.verifiedOn = DateUtils.getLocalDateOfTenant();
+        this.verifiedOn = DateUtils.getBusinessLocalDate();
         this.ckycNumber = StringUtils.defaultIfEmpty(ckycNumber, null);
 
         final KycRiskCategory risk = KycRiskCategory.fromInt(this.riskCategory);
@@ -709,21 +796,21 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
             return this.expiryDate;
         }
 
-        this.expiryDate = DateUtils.getLocalDateOfTenant().plusYears(risk.getReKycYears());
+        this.expiryDate = DateUtils.getBusinessLocalDate().plusYears(risk.getReKycYears());
         return this.expiryDate;
     }
 
     /** Called when verification fails. */
     public void markRejected(final String remarks) {
         this.kycStatus = ClientKycStatus.REJECTED.getValue();
-        this.rejectedOn = DateUtils.getLocalDateOfTenant();
+        this.rejectedOn = DateUtils.getBusinessLocalDate();
         this.remarks = StringUtils.defaultIfEmpty(remarks, this.remarks);
     }
 
     public void markPanVerified(final String fullName, final String firstName, final String lastName,
             final String aadhaarSeedingStatus, final String category, final String status) {
         this.panVerified = true;
-        this.panVerifiedOn = DateUtils.getLocalDateOfTenant();
+        this.panVerifiedOn = DateUtils.getBusinessLocalDate();
         this.panFullName = StringUtils.defaultIfEmpty(fullName, null);
         this.panFirstName = StringUtils.defaultIfEmpty(firstName, null);
         this.panLastName = StringUtils.defaultIfEmpty(lastName, null);
@@ -749,28 +836,28 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
 
     public void markAadhaarVerified() {
         this.aadhaarVerified = true;
-        this.aadhaarVerifiedOn = DateUtils.getLocalDateOfTenant();
+        this.aadhaarVerifiedOn = DateUtils.getBusinessLocalDate();
     }
 
     public void markGstinVerified() {
         this.gstinVerified = true;
-        this.gstinVerifiedOn = DateUtils.getLocalDateOfTenant();
+        this.gstinVerifiedOn = DateUtils.getBusinessLocalDate();
     }
 
     public void markCinVerified() {
         this.cinVerified = true;
-        this.cinVerifiedOn = DateUtils.getLocalDateOfTenant();
+        this.cinVerifiedOn = DateUtils.getBusinessLocalDate();
     }
 
     public void markDinVerified() {
         this.dinVerified = true;
-        this.dinVerifiedOn = DateUtils.getLocalDateOfTenant();
+        this.dinVerifiedOn = DateUtils.getBusinessLocalDate();
     }
 
     public void markDinVerified(final String dinNumber, final String mcaResponseJson) {
         this.dinNumber = dinNumber;
         this.dinVerified = true;
-        this.dinVerifiedOn = DateUtils.getLocalDateOfTenant();
+        this.dinVerifiedOn = DateUtils.getBusinessLocalDate();
         this.isDirector = true;
         this.dinMcaResponse = mcaResponseJson;
     }
@@ -791,7 +878,17 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         } else if (type != null && type.isNonIndividual()) {
             allDone = this.panVerified && this.gstinVerified;
         }
-        if (allDone && !getKycStatus().isVerified()) {
+        // Re-stamped even when the record already reads VERIFIED, because that is exactly what a
+        // periodic re-KYC is: an already-verified customer verified afresh.
+        //
+        // Skipping it there left verifiedOn — and with it the expiry date, and the dormancy clock
+        // that now measures from it — frozen at the original onboarding. An officer who re-verified
+        // both PAN and Aadhaar at the counter saw both rows stamped with today's date and the
+        // account still sitting on the inactive report, with nothing to say what was missing.
+        //
+        // Guarded on the verifications rather than the status, so this only fires when the checks
+        // that constitute a verification have actually been done again.
+        if (allDone) {
             markVerified(this.ckycNumber);
         }
         return allDone;
@@ -839,6 +936,26 @@ public class ClientKyc extends AbstractAuditableWithUTCDateTimeCustom<Long> {
         recalculateExpiryForRiskCategory();
     }
 
+    public boolean isPep() {
+        return this.isPep;
+    }
+
+    public boolean isSanctionsMatch() {
+        return this.sanctionsMatch;
+    }
+
+    public boolean isAdverseMediaMatch() {
+        return this.adverseMediaMatch;
+    }
+
+    public BigDecimal getDeclaredAnnualIncome() {
+        return this.declaredAnnualIncome;
+    }
+
+    public BigDecimal getDeclaredAnnualTurnover() {
+        return this.declaredAnnualTurnover;
+    }
+
     public String getPanNumber() {
         return panNumber;
     }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/ClientRiskRule.java

@@ -93,6 +93,26 @@ public class ClientRiskRule {
     @Column(name = "order_position", nullable = false)
     private Integer orderPosition;
 
+    /**
+     * Which of the two rule families this row belongs to - {@link #KIND_KYC} or {@link #KIND_AML}.
+     *
+     * This table carries both, and they are not interchangeable. A KYC rule is profile-driven: it
+     * reads occupation / income / turnover to categorise a customer at onboarding (RBI Master
+     * Direction on KYC, Section 12). An AML rule is behaviour-driven: it describes a transaction
+     * pattern and may only fire against posted transactions, surfacing in {@code m_aml_alert}
+     * (Section 13).
+     *
+     * The distinction used to be inferred from "has no criteria set", which migration 0448 erased
+     * by writing 0.0 over the NULLs - after which transaction-monitoring rules began matching
+     * ordinary customers at onboarding and pre-flagging them for AML. Recording the kind means a
+     * rule states what it is; nothing has to guess from the shape of its other columns.
+     */
+    @Column(name = "rule_kind", length = 10)
+    private String ruleKind;
+
+    public static final String KIND_KYC = "KYC";
+    public static final String KIND_AML = "AML";
+
     protected ClientRiskRule() {}
 
     /**
@@ -104,8 +124,9 @@ public class ClientRiskRule {
             final BigDecimal maxMonthlyIncome, final BigDecimal minAnnualIncome, final BigDecimal maxAnnualIncome,
             final BigDecimal minAnnualTurnover, final BigDecimal maxAnnualTurnover, final String amlCheckStatus,
             final String bannedEntityMatch, final String willfulDefaulter, final String ecgcSalFlag,
-            final String dormantFlag) {
+            final String dormantFlag, final String ruleKind) {
         final ClientRiskRule rule = new ClientRiskRule();
+        rule.ruleKind = ruleKind;
         rule.ruleName = ruleName;
         rule.reason = reason;
         rule.riskCategory = riskCategory;
@@ -137,6 +158,19 @@ public class ClientRiskRule {
         return id;
     }
 
+    public String getRuleKind() {
+        return ruleKind;
+    }
+
+    /**
+     * True when this rule may take part in onboarding risk categorisation. Rows predating the
+     * rule_kind column are treated as KYC, matching how they behaved before AML rules were seeded
+     * into the same table.
+     */
+    public boolean isKycRule() {
+        return !KIND_AML.equalsIgnoreCase(this.ruleKind);
+    }
+
     public String getRuleName() {
         return ruleName;
     }

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/RiskPolicyParameter.java

@@ -0,0 +1,74 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.domain;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+
+/**
+ * One number the risk re-rating policy is made of - a window length, a minimum transaction count, a cash threshold.
+ *
+ * <p>
+ * Held as data because these are the bank's risk appetite rather than engineering constants. How long a customer must
+ * behave before a High rating comes down is a compliance judgement, and a co-operative bank whose members transact
+ * three times a month needs different figures from one lending to traders.
+ */
+@Entity
+@Table(name = "m_risk_policy_parameter")
+public class RiskPolicyParameter {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "parameter_key", nullable = false, length = 80)
+    private String parameterKey;
+
+    @Column(name = "parameter_value", nullable = false, precision = 19, scale = 2)
+    private BigDecimal parameterValue;
+
+    @Column(name = "description", length = 500)
+    private String description;
+
+    @Column(name = "last_modified_by")
+    private Long lastModifiedBy;
+
+    @Column(name = "last_modified_on")
+    private LocalDateTime lastModifiedOn;
+
+    protected RiskPolicyParameter() {}
+
+    public String getParameterKey() {
+        return this.parameterKey;
+    }
+
+    public BigDecimal getParameterValue() {
+        return this.parameterValue;
+    }
+
+    public String getDescription() {
+        return this.description;
+    }
+}

fineract-core/src/main/java/org/apache/fineract/portfolio/client/domain/RiskPolicyParameterRepository.java

@@ -0,0 +1,23 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.client.domain;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface RiskPolicyParameterRepository extends JpaRepository<RiskPolicyParameter, Long> {}

fineract-core/src/main/java/org/apache/fineract/portfolio/paymenttype/api/PaymentTypeApiResource.java

@@ -31,20 +31,15 @@ import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import java.util.List;
-import java.util.function.Supplier;
 import lombok.RequiredArgsConstructor;
-import org.apache.fineract.command.core.CommandPipeline;
+import org.apache.fineract.commands.domain.CommandWrapper;
+import org.apache.fineract.commands.service.CommandWrapperBuilder;
+import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformService;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
-import org.apache.fineract.portfolio.paymenttype.command.PaymentTypeCreateCommand;
-import org.apache.fineract.portfolio.paymenttype.command.PaymentTypeDeleteCommand;
-import org.apache.fineract.portfolio.paymenttype.command.PaymentTypeUpdateCommand;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeCreateRequest;
-import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeCreateResponse;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeData;
-import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeDeleteRequest;
-import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeDeleteResponse;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeUpdateRequest;
-import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeUpdateResponse;
 import org.apache.fineract.portfolio.paymenttype.service.PaymentTypeReadService;
 import org.springframework.stereotype.Component;
 
@@ -55,7 +50,7 @@ import org.springframework.stereotype.Component;
 public class PaymentTypeApiResource {
 
     private final PaymentTypeReadService readPlatformService;
-    private final CommandPipeline commandPipeline;
+    private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
     private final DefaultToApiJsonSerializer<PaymentTypeData> jsonSerializer;
 
     @GET
@@ -79,14 +74,13 @@ public class PaymentTypeApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     @Operation(summary = "Create a Payment Type", description = "Creates a new Payment type")
-    public PaymentTypeCreateResponse createPaymentType(PaymentTypeCreateRequest request) {
+    public String createPaymentType(final PaymentTypeCreateRequest request) {
-        final var command = new PaymentTypeCreateCommand();
+        final CommandWrapper commandRequest = new CommandWrapperBuilder().createPaymentType()
+                .withJson(jsonSerializer.serialize(request)).build();
 
-        command.setPayload(request);
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
 
-        final Supplier<PaymentTypeCreateResponse> response = commandPipeline.send(command);
+        return jsonSerializer.serialize(result);
-
-        return response.get();
     }
 
     @PUT
@@ -94,18 +88,16 @@ public class PaymentTypeApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     @Operation(summary = "Update a Payment Type", description = "Updates a Payment Type")
-    public PaymentTypeUpdateResponse updatePaymentType(@PathParam("paymentTypeId") final Long paymentTypeId,
+    public String updatePaymentType(@PathParam("paymentTypeId") final Long paymentTypeId, final PaymentTypeUpdateRequest request) {
-            final PaymentTypeUpdateRequest request) {
 
         request.setId(paymentTypeId);
 
-        final var command = new PaymentTypeUpdateCommand();
+        final CommandWrapper commandRequest = new CommandWrapperBuilder().updatePaymentType(paymentTypeId)
+                .withJson(jsonSerializer.serialize(request)).build();
 
-        command.setPayload(request);
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
 
-        final Supplier<PaymentTypeUpdateResponse> response = commandPipeline.send(command);
+        return jsonSerializer.serialize(result);
-
-        return response.get();
     }
 
     @DELETE
@@ -113,14 +105,12 @@ public class PaymentTypeApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     @Operation(summary = "Delete a Payment Type", description = "Deletes payment type")
-    public PaymentTypeDeleteResponse deleteCode(@PathParam("paymentTypeId") final Long paymentTypeId) {
+    public String deleteCode(@PathParam("paymentTypeId") final Long paymentTypeId) {
 
-        final var command = new PaymentTypeDeleteCommand();
+        final CommandWrapper commandRequest = new CommandWrapperBuilder().deletePaymentType(paymentTypeId).build();
 
-        command.setPayload(PaymentTypeDeleteRequest.builder().id(paymentTypeId).build());
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
 
-        final Supplier<PaymentTypeDeleteResponse> response = commandPipeline.send(command);
+        return jsonSerializer.serialize(result);
-
-        return response.get();
     }
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/paymenttype/handler/PaymentTypeCreateCommandHandler.java

@@ -18,33 +18,50 @@
  */
 package org.apache.fineract.portfolio.paymenttype.handler;
 
-import io.github.resilience4j.retry.annotation.Retry;
+import org.apache.fineract.commands.annotation.CommandType;
-import lombok.RequiredArgsConstructor;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
-import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
-import org.apache.fineract.command.core.Command;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
-import org.apache.fineract.command.core.CommandHandler;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeCreateRequest;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeCreateResponse;
 import org.apache.fineract.portfolio.paymenttype.service.PaymentTypeWriteService;
-import org.springframework.stereotype.Component;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-@Slf4j
+@Service
-@Component
+@CommandType(entity = "PAYMENTTYPE", action = "CREATE")
-@RequiredArgsConstructor
+public class PaymentTypeCreateCommandHandler implements NewCommandSourceHandler {
-public class PaymentTypeCreateCommandHandler implements CommandHandler<PaymentTypeCreateRequest, PaymentTypeCreateResponse> {
 
     private final PaymentTypeWriteService paymentTypeWriteService;
 
-    @Retry(name = "commandPaymentTypeCreate", fallbackMethod = "fallback")
+    @Autowired
-    @Override
+    public PaymentTypeCreateCommandHandler(final PaymentTypeWriteService paymentTypeWriteService) {
-    @Transactional
+        this.paymentTypeWriteService = paymentTypeWriteService;
-    public PaymentTypeCreateResponse handle(Command<PaymentTypeCreateRequest> command) {
-        return paymentTypeWriteService.createPaymentType(command.getPayload());
     }
 
+    @Transactional
     @Override
-    public PaymentTypeCreateResponse fallback(Command<PaymentTypeCreateRequest> command, Throwable t) {
+    public CommandProcessingResult processCommand(final JsonCommand command) {
-        return CommandHandler.super.fallback(command, t);
+
+        final Boolean isSystemDefined = command.booleanObjectValueOfParameterNamed("isSystemDefined");
+
+        final PaymentTypeCreateRequest request = PaymentTypeCreateRequest.builder()
+                .name(command.stringValueOfParameterNamed("name"))
+                .description(command.stringValueOfParameterNamed("description"))
+                .isCashPayment(command.booleanObjectValueOfParameterNamed("isCashPayment"))
+                .position(command.longValueOfParameterNamed("position"))
+                .codeName(command.stringValueOfParameterNamed("codeName"))
+                .isSystemDefined(isSystemDefined != null ? isSystemDefined : Boolean.FALSE)
+                .build();
+
+        final PaymentTypeCreateResponse response = this.paymentTypeWriteService.createPaymentType(request);
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .withEntityId(response.getResourceId()) //
+                .build();
     }
+
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/paymenttype/handler/PaymentTypeDeleteCommandHandler.java

@@ -18,33 +18,41 @@
  */
 package org.apache.fineract.portfolio.paymenttype.handler;
 
-import io.github.resilience4j.retry.annotation.Retry;
+import org.apache.fineract.commands.annotation.CommandType;
-import lombok.RequiredArgsConstructor;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
-import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
-import org.apache.fineract.command.core.Command;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
-import org.apache.fineract.command.core.CommandHandler;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeDeleteRequest;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeDeleteResponse;
 import org.apache.fineract.portfolio.paymenttype.service.PaymentTypeWriteService;
-import org.springframework.stereotype.Component;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-@Slf4j
+@Service
-@Component
+@CommandType(entity = "PAYMENTTYPE", action = "DELETE")
-@RequiredArgsConstructor
+public class PaymentTypeDeleteCommandHandler implements NewCommandSourceHandler {
-public class PaymentTypeDeleteCommandHandler implements CommandHandler<PaymentTypeDeleteRequest, PaymentTypeDeleteResponse> {
 
     private final PaymentTypeWriteService paymentTypeWriteService;
 
-    @Retry(name = "commandPaymentTypeDelete", fallbackMethod = "fallback")
+    @Autowired
-    @Override
+    public PaymentTypeDeleteCommandHandler(final PaymentTypeWriteService paymentTypeWriteService) {
-    @Transactional
+        this.paymentTypeWriteService = paymentTypeWriteService;
-    public PaymentTypeDeleteResponse handle(Command<PaymentTypeDeleteRequest> command) {
-        return paymentTypeWriteService.deletePaymentType(command.getPayload());
     }
 
+    @Transactional
     @Override
-    public PaymentTypeDeleteResponse fallback(Command<PaymentTypeDeleteRequest> command, Throwable t) {
+    public CommandProcessingResult processCommand(final JsonCommand command) {
-        return CommandHandler.super.fallback(command, t);
+
+        final PaymentTypeDeleteRequest request = PaymentTypeDeleteRequest.builder().id(command.entityId()).build();
+
+        final PaymentTypeDeleteResponse response = this.paymentTypeWriteService.deletePaymentType(request);
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .withEntityId(response.getResourceId()) //
+                .build();
     }
+
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/paymenttype/handler/PaymentTypeUpdateCommandHandler.java

@@ -18,33 +18,51 @@
  */
 package org.apache.fineract.portfolio.paymenttype.handler;
 
-import io.github.resilience4j.retry.annotation.Retry;
+import org.apache.fineract.commands.annotation.CommandType;
-import lombok.RequiredArgsConstructor;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
-import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
-import org.apache.fineract.command.core.Command;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
-import org.apache.fineract.command.core.CommandHandler;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeUpdateRequest;
 import org.apache.fineract.portfolio.paymenttype.data.PaymentTypeUpdateResponse;
 import org.apache.fineract.portfolio.paymenttype.service.PaymentTypeWriteService;
-import org.springframework.stereotype.Component;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-@Slf4j
+@Service
-@Component
+@CommandType(entity = "PAYMENTTYPE", action = "UPDATE")
-@RequiredArgsConstructor
+public class PaymentTypeUpdateCommandHandler implements NewCommandSourceHandler {
-public class PaymentTypeUpdateCommandHandler implements CommandHandler<PaymentTypeUpdateRequest, PaymentTypeUpdateResponse> {
 
     private final PaymentTypeWriteService paymentTypeWriteService;
 
-    @Retry(name = "commandPaymentTypeUpdate", fallbackMethod = "fallback")
+    @Autowired
-    @Override
+    public PaymentTypeUpdateCommandHandler(final PaymentTypeWriteService paymentTypeWriteService) {
-    @Transactional
+        this.paymentTypeWriteService = paymentTypeWriteService;
-    public PaymentTypeUpdateResponse handle(Command<PaymentTypeUpdateRequest> command) {
-        return paymentTypeWriteService.updatePaymentType(command.getPayload());
     }
 
+    @Transactional
     @Override
-    public PaymentTypeUpdateResponse fallback(Command<PaymentTypeUpdateRequest> command, Throwable t) {
+    public CommandProcessingResult processCommand(final JsonCommand command) {
-        return CommandHandler.super.fallback(command, t);
+
+        final Boolean isSystemDefined = command.booleanObjectValueOfParameterNamed("isSystemDefined");
+
+        final PaymentTypeUpdateRequest request = PaymentTypeUpdateRequest.builder()
+                .id(command.entityId())
+                .name(command.stringValueOfParameterNamed("name"))
+                .description(command.stringValueOfParameterNamed("description"))
+                .isCashPayment(command.booleanObjectValueOfParameterNamed("isCashPayment"))
+                .position(command.longValueOfParameterNamed("position"))
+                .codeName(command.stringValueOfParameterNamed("codeName"))
+                .isSystemDefined(isSystemDefined != null ? isSystemDefined : Boolean.FALSE)
+                .build();
+
+        final PaymentTypeUpdateResponse response = this.paymentTypeWriteService.updatePaymentType(request);
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .withEntityId(response.getResourceId()) //
+                .build();
     }
+
 }

fineract-core/src/main/java/org/apache/fineract/portfolio/savings/DepositsApiConstants.java

@@ -123,6 +123,7 @@ public final class DepositsApiConstants {
     public static final String isSeniorCitizenParamName = "isSeniorCitizen";
     public static final String seniorCitizenInterestRateParamName = "seniorCitizenInterestRate";
     public static final String tenureInMonthsParamName = "tenureInMonths";
+    public static final String tenureInDaysParamName = "tenureInDays";
     public static final String interestCompoundingPeriodInMonthsParamName = "interestCompoundingPeriodInMonths";
 
     // Preclosure parameters
@@ -142,6 +143,9 @@ public final class DepositsApiConstants {
     public static final String inMultiplesOfDepositTermParamName = "inMultiplesOfDepositTerm";
     public static final String inMultiplesOfDepositTermTypeIdParamName = "inMultiplesOfDepositTermTypeId";
     public static final String inMultiplesOfDepositTermType = "inMultiplesOfDepositTermType";
+    // Days after maturity a depositor still has to walk in and renew at the original maturity date --
+    // null/0 means this product keeps the instant, same-night auto-renewal every FD product had before.
+    public static final String renewalGracePeriodDaysParamName = "renewalGracePeriodDays";
 
     public static final String depositAmountParamName = "depositAmount";
     public static final String depositMinAmountParamName = "minDepositAmount";
@@ -247,11 +251,13 @@ public final class DepositsApiConstants {
 
     private static final Set<String> DEPOSIT_TERM_REQUEST_DATA_PARAMETERS = new HashSet<>(Arrays.asList(minDepositTermParamName,
             maxDepositTermParamName, minDepositTermTypeIdParamName, maxDepositTermTypeIdParamName, inMultiplesOfDepositTermParamName,
-            inMultiplesOfDepositTermTypeIdParamName, depositAmountParamName, depositMinAmountParamName, depositMaxAmountParamName));
+            inMultiplesOfDepositTermTypeIdParamName, depositAmountParamName, depositMinAmountParamName, depositMaxAmountParamName,
+            renewalGracePeriodDaysParamName));
 
     private static final Set<String> DEPOSIT_TERM_RESPONSE_DATA_PARAMETERS = new HashSet<>(Arrays.asList(minDepositTermParamName,
             maxDepositTermParamName, minDepositTermType, maxDepositTermType, inMultiplesOfDepositTermParamName,
-            inMultiplesOfDepositTermType, depositAmountParamName, depositMinAmountParamName, depositMaxAmountParamName));
+            inMultiplesOfDepositTermType, depositAmountParamName, depositMinAmountParamName, depositMaxAmountParamName,
+            renewalGracePeriodDaysParamName));
 
     private static final Set<String> RECURRING_DETAILS_REQUEST_DATA_PARAMETERS = new HashSet<>(
             Arrays.asList(mandatoryRecommendedDepositAmountParamName, isMandatoryDepositParamName, allowWithdrawalParamName,
@@ -511,6 +517,7 @@ public final class DepositsApiConstants {
         fixedDepositInterestCalculationData.add(principalAmountParamName);
         fixedDepositInterestCalculationData.add(annualInterestRateParamName);
         fixedDepositInterestCalculationData.add(tenureInMonthsParamName);
+        fixedDepositInterestCalculationData.add(tenureInDaysParamName);
         fixedDepositInterestCalculationData.add(interestPostingPeriodInMonthsParamName);
         fixedDepositInterestCalculationData.add(interestCompoundingPeriodInMonthsParamName);
         // Exact calendar-based calculation params

fineract-core/src/main/java/org/apache/fineract/portfolio/savings/SavingsApiConstants.java

@@ -286,6 +286,15 @@ public class SavingsApiConstants {
     public static final String avgBalanceCalcPeriodParamName = "avgBalanceCalcPeriod";
     public static final String validForPeriodParamName = "validForPeriod";
     public static final String odAccountClosedZeroBalanceInDayClosingParamName = "odAccountClosedZeroBalanceInDayClosing";
+    // Overdraft scheme rules a sanction on an account is held to: overdraftLimit is the ceiling (an
+    // amount), odMinLimit the floor, odSecurityType whether the limit may be clean, secured, or either.
+    public static final String odMinLimitParamName = "odMinLimit";
+    public static final String odSecurityTypeParamName = "odSecurityType";
+    // Excess drawing: whether an account may go past its sanctioned limit, by how much (a percentage of the
+    // limit), and the penal charge (% p.a.) levied on the excess alone for the days it stays excess.
+    public static final String odExcessAllowedParamName = "odExcessAllowed";
+    public static final String odExcessLimitPercentParamName = "odExcessLimitPercent";
+    public static final String odPenalRateParamName = "odPenalRate";
 
     // Status of Account fields
     public static final String accountStatusParamName = "accountStatus";

fineract-core/src/main/java/org/apache/fineract/portfolio/savings/data/SavingsProductData.java

@@ -152,6 +152,11 @@ public final class SavingsProductData implements Serializable {
     @Getter @Setter private String avgBalanceCalcPeriod;
     @Getter @Setter private String validForPeriod;
     @Getter @Setter private Boolean odAccountClosedZeroBalanceInDayClosing;
+    @Getter @Setter private BigDecimal odMinLimit;
+    @Getter @Setter private String odSecurityType;
+    @Getter @Setter private Boolean odExcessAllowed;
+    @Getter @Setter private BigDecimal odExcessLimitPercent;
+    @Getter @Setter private BigDecimal odPenalRate;
 
     // Complex objects wrapped as Maps/Lists so Jackson converts them into the exact JSON your UI expects
     @Getter @Setter private Map<String, Object> accountFacilityConfig;
@@ -382,6 +387,11 @@ public final class SavingsProductData implements Serializable {
         target.setAvgBalanceCalcPeriod(source.getAvgBalanceCalcPeriod());
         target.setValidForPeriod(source.getValidForPeriod());
         target.setOdAccountClosedZeroBalanceInDayClosing(source.getOdAccountClosedZeroBalanceInDayClosing());
+        target.setOdMinLimit(source.getOdMinLimit());
+        target.setOdSecurityType(source.getOdSecurityType());
+        target.setOdExcessAllowed(source.getOdExcessAllowed());
+        target.setOdExcessLimitPercent(source.getOdExcessLimitPercent());
+        target.setOdPenalRate(source.getOdPenalRate());
         target.setOtherGlMappingsMap(source.getOtherGlMappingsMap());
         target.setAccountFacilityConfig(source.getAccountFacilityConfig());
         target.setAccountFacilityLimits(source.getAccountFacilityLimits());

fineract-core/src/main/java/org/apache/fineract/portfolio/savings/domain/interest/PostingPeriod.java

@@ -256,7 +256,16 @@ public final class PostingPeriod {
         this.daysInYear = daysInYear;
         this.compoundingPeriods = compoundingPeriods;
 
-        if (isSavingsInterestPostingAtCurrentPeriodEnd) {
+        if (isUserPosting) {
+            // "Post interest as on D" — a closure, or the same action from the account screen. The
+            // period it covers ends at D-1, because interest is earned up to but not including the
+            // day it is paid, and SavingsHelper closes the period there. The transaction itself
+            // still belongs on D: that is the day the member was credited, the day the branch did
+            // the work, and the day the cash is handed over. Dating it to the period end instead
+            // stamps it a day before the account was even closed, and the ledger then disagrees with
+            // the closure request, the voucher and the passbook — all of which carry D.
+            this.dateOfPostingTransaction = periodInterval.endDate().plusDays(1);
+        } else if (isSavingsInterestPostingAtCurrentPeriodEnd) {
             this.dateOfPostingTransaction = periodInterval.endDate();
         } else {
             this.dateOfPostingTransaction = periodInterval.endDate().plusDays(1);

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/domain/CurrentAccount.java

@@ -76,7 +76,8 @@ public class CurrentAccount extends AbstractAuditableCustom {
     @Column(name = "status_enum", nullable = false)
     private Integer statusEnum = 100;
 
-    // SubStatus: 0=None, 100=Inactive, 200=Dormant, 300=Block, 400=BlockDebit, 500=BlockCredit
+    // SubStatus, same codes as savings: 0=None, 100=Inactive, 200=Dormant, 300=Escheat, 400=Block, 500=BlockCredit,
+    // 600=BlockDebit
     @Column(name = "sub_status_enum", nullable = false)
     private Integer subStatusEnum = 0;
 

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/domain/CurrentAccountRepository.java

@@ -38,6 +38,12 @@ public interface CurrentAccountRepository extends JpaRepository<CurrentAccount,
     @Query("SELECT ca FROM CurrentAccount ca WHERE ca.client.id = :clientId AND ca.statusEnum != 600")
     List<CurrentAccount> findActiveByClientId(@Param("clientId") Long clientId);
 
-    @Query("SELECT COUNT(ca) FROM CurrentAccount ca WHERE ca.client.id = :clientId AND ca.productId = :productId AND ca.statusEnum != 600")
+    // statusEnum != 600 (CLOSED) let a client re-apply for the same product only once every prior
+    // account on it was closed -- but 400 (WITHDRAWN) and 500 (REJECTED), see CurrentAccount.withdraw()
+    // /.reject(), are equally terminal and were still being counted as "still has one", blocking a
+    // fresh application the client should have been free to make. 100/200/300 (submitted, approved,
+    // active) are the only statuses a second application on the same product should actually collide
+    // with.
+    @Query("SELECT COUNT(ca) FROM CurrentAccount ca WHERE ca.client.id = :clientId AND ca.productId = :productId AND ca.statusEnum IN (100, 200, 300)")
     long countActiveByClientAndProduct(@Param("clientId") Long clientId, @Param("productId") Long productId);
 }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/domain/CurrentAccountTransaction.java

@@ -46,7 +46,7 @@ public class CurrentAccountTransaction extends AbstractPersistableCustom<Long> {
     @JoinColumn(name = "office_id", nullable = false)
     private Office office;
 
-    // 1=Deposit, 2=Withdrawal, 3=InterestPosting, 4=Charge, 5=ChargeWaiver, 6=Transfer, 7=Reversal
+    // 1=Deposit, 2=Withdrawal, 3=InterestPosting, 4=Charge, 5=ChargeWaiver, 6=Transfer, 7=Reversal, 19=Escheat
     @Column(name = "transaction_type_enum", nullable = false)
     private Integer transactionTypeEnum;
 
@@ -176,6 +176,20 @@ public class CurrentAccountTransaction extends AbstractPersistableCustom<Long> {
         return txn;
     }
 
+    // transactionTypeEnum = 19 (Escheat) -- the whole balance moved to the escheat liability, same code as savings
+    public static CurrentAccountTransaction escheat(CurrentAccount account, Office office,
+            BigDecimal amount, LocalDate transactionDate) {
+        CurrentAccountTransaction txn = new CurrentAccountTransaction();
+        txn.currentAccount = account;
+        txn.office = office;
+        txn.transactionTypeEnum = 19;
+        txn.amount = amount;
+        txn.transactionDate = transactionDate;
+        txn.remarks = "Escheat: dormant for the product's escheat period, balance moved to the escheat liability";
+        txn.submittedOnDate = transactionDate;
+        return txn;
+    }
+
     // transactionTypeEnum = 7 (Reversal / Undo)
     public static CurrentAccountTransaction reversal(CurrentAccount account, Office office,
             BigDecimal amount, LocalDate transactionDate, Long originalTransactionId) {

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentaccount/service/CurrentAccountTransactionWritePlatformService.java

@@ -36,4 +36,10 @@ public interface CurrentAccountTransactionWritePlatformService {
     CommandProcessingResult reverseTransaction(Long accountId, Long transactionId, boolean isReversal, JsonCommand command);
 
     CommandProcessingResult adjustTransaction(Long accountId, Long transactionId, JsonCommand command);
+
+    /**
+     * Escheats a dormant current account: moves its whole balance to the escheat liability and closes it. Run by the
+     * nightly dormancy job; returns false, leaving the account untouched, where it cannot safely be done.
+     */
+    boolean escheat(Long accountId);
 }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/data/CurrentProductDataValidator.java

@@ -44,7 +44,13 @@ import static org.apache.fineract.portfolio.savings.SavingsApiConstants.minRequi
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.nameParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.nominalAnnualInterestRateOverdraftParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.nominalAnnualInterestRateParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odExcessAllowedParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odExcessLimitPercentParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odMinLimitParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odPenalRateParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odSecurityTypeParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.overdraftLimitParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.validForPeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.shortNameParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.taxGroupIdParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.withHoldTaxParamName;
@@ -136,7 +142,17 @@ public class CurrentProductDataValidator {
             SavingsApiConstants.balanceSwapOptionParamName, SavingsApiConstants.msmeParamName,
             SavingsApiConstants.autoDebitFacilityParamName, SavingsApiConstants.avgBalanceCalcPeriodParamName,
             SavingsApiConstants.validForPeriodParamName, SavingsApiConstants.odAccountClosedZeroBalanceInDayClosingParamName,
-            SavingsApiConstants.glAccountIdParamName));
+            odMinLimitParamName, odSecurityTypeParamName, odExcessAllowedParamName, odExcessLimitPercentParamName,
+            odPenalRateParamName, SavingsApiConstants.glAccountIdParamName));
+
+    /** How long an OD sanction on this scheme runs before it has to be renewed. */
+    private static final List<String> OD_VALIDITY_PERIODS = List.of("3M", "6M", "1Y", "2Y", "3Y");
+    /** CLEAN: no security needed; SECURED: backed by FD lien, property etc.; BOTH: decided per sanction. */
+    private static final List<String> OD_SECURITY_TYPES = List.of("CLEAN", "SECURED", "BOTH");
+    /** A sanity ceiling on the OD rate, catching a limit keyed into the rate field. */
+    private static final BigDecimal MAX_OVERDRAFT_RATE = new BigDecimal("50");
+    /** Excess drawing is a small tolerance over the limit, never a second limit. */
+    private static final BigDecimal MAX_EXCESS_PERCENT = new BigDecimal("25");
 
     public void validateForCreate(final String json) {
         if (StringUtils.isBlank(json)) {
@@ -260,10 +276,10 @@ public class CurrentProductDataValidator {
         if (AccountingValidations.isCashBasedAccounting(accountingRuleType)
                 || AccountingValidations.isAccrualPeriodicBasedAccounting(accountingRuleType)) {
             savingsProductAccountingDataValidator.evaluateProductAccountingData(accountingRuleType, isDormancyActive, element,
-                    baseDataValidator, DepositAccountType.SAVINGS_DEPOSIT, true);
+                    baseDataValidator, DepositAccountType.CURRENT_DEPOSIT, true);
         }
 
-        validateOverdraftParams(baseDataValidator, element);
+        validateOverdraftParams(baseDataValidator, element, null);
 
         if (this.fromApiJsonHelper.parameterExists(minBalanceForInterestCalculationParamName, element)) {
             final BigDecimal minBalanceForInterestCalculation = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(minBalanceForInterestCalculationParamName, element);
@@ -358,7 +374,7 @@ public class CurrentProductDataValidator {
         if (AccountingValidations.isCashBasedAccounting(accountingRuleType)
                 || AccountingValidations.isAccrualPeriodicBasedAccounting(accountingRuleType)) {
             savingsProductAccountingDataValidator.evaluateProductAccountingData(accountingRuleType, isDormancyActive, element,
-                    baseDataValidator, DepositAccountType.SAVINGS_DEPOSIT, false);
+                    baseDataValidator, DepositAccountType.CURRENT_DEPOSIT, false);
         }
 
         if (null != isDormancyActive && isDormancyActive) {
@@ -380,7 +396,7 @@ public class CurrentProductDataValidator {
             }
         }
 
-        validateOverdraftParams(baseDataValidator, element);
+        validateOverdraftParams(baseDataValidator, element, product);
 
         if (this.fromApiJsonHelper.parameterExists(minBalanceForInterestCalculationParamName, element)) {
             final BigDecimal minBalanceForInterestCalculation = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(minBalanceForInterestCalculationParamName, element);
@@ -398,23 +414,103 @@ public class CurrentProductDataValidator {
         }
     }
 
-    private void validateOverdraftParams(final DataValidatorBuilder baseDataValidator, final JsonElement element) {
+    /**
+     * The overdraft section of a current product is the scheme every account's OD sanction is held to, so when OD is
+     * allowed it has to be complete: a ceiling (overdraftLimit, an amount, not a percentage), an optional floor, a rate,
+     * a sanction validity and whether the limit may be clean or must be secured. Interest on an OD is applied monthly,
+     * as RBI requires for advances, or at most quarterly.
+     *
+     * On update, product is the stored product and fills in any value the request leaves out, so a partial edit is
+     * checked against the scheme it will produce; on create it is null.
+     */
+    private void validateOverdraftParams(final DataValidatorBuilder baseDataValidator, final JsonElement element,
+            final CurrentProduct product) {
         if (this.fromApiJsonHelper.parameterExists(allowOverdraftParamName, element)) {
             final Boolean allowOverdraft = this.fromApiJsonHelper.extractBooleanNamed(allowOverdraftParamName, element);
             baseDataValidator.reset().parameter(allowOverdraftParamName).value(allowOverdraft).ignoreIfNull().validateForBooleanValue();
         }
-        if (this.fromApiJsonHelper.parameterExists(overdraftLimitParamName, element)) {
+        final boolean allowOverdraft = this.fromApiJsonHelper.parameterExists(allowOverdraftParamName, element)
-            final BigDecimal overdraftLimit = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(overdraftLimitParamName, element);
+                ? BooleanUtils.isTrue(this.fromApiJsonHelper.extractBooleanNamed(allowOverdraftParamName, element))
-            baseDataValidator.reset().parameter(overdraftLimitParamName).value(overdraftLimit).ignoreIfNull().zeroOrPositiveAmount();
+                : product != null && product.isAllowOverdraft();
+
+        final BigDecimal maxLimit = bigDecimalOrStored(element, overdraftLimitParamName,
+                product == null ? null : product.getOverdraftLimit());
+        final BigDecimal minLimit = bigDecimalOrStored(element, odMinLimitParamName, product == null ? null : product.getOdMinLimit());
+        final BigDecimal rate = bigDecimalOrStored(element, nominalAnnualInterestRateOverdraftParamName,
+                product == null ? null : product.getNominalAnnualInterestRateOverdraft());
+        final BigDecimal minOdForInterest = bigDecimalOrStored(element, minOverdraftForInterestCalculationParamName,
+                product == null ? null : product.getMinOverdraftForInterestCalculation());
+
+        if (!allowOverdraft) {
+            baseDataValidator.reset().parameter(overdraftLimitParamName).value(maxLimit).ignoreIfNull().zeroOrPositiveAmount();
+            baseDataValidator.reset().parameter(nominalAnnualInterestRateOverdraftParamName).value(rate).ignoreIfNull()
+                    .zeroOrPositiveAmount();
+            baseDataValidator.reset().parameter(minOverdraftForInterestCalculationParamName).value(minOdForInterest).ignoreIfNull()
+                    .zeroOrPositiveAmount();
+            return;
         }
-        if (this.fromApiJsonHelper.parameterExists(nominalAnnualInterestRateOverdraftParamName, element)) {
+
-            final BigDecimal nominalAnnualInterestRateOverdraft = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(nominalAnnualInterestRateOverdraftParamName, element);
+        baseDataValidator.reset().parameter(overdraftLimitParamName).value(maxLimit).notNull().positiveAmount();
-            baseDataValidator.reset().parameter(nominalAnnualInterestRateOverdraftParamName).value(nominalAnnualInterestRateOverdraft).ignoreIfNull().zeroOrPositiveAmount();
+        baseDataValidator.reset().parameter(odMinLimitParamName).value(minLimit).ignoreIfNull().zeroOrPositiveAmount();
+        if (minLimit != null && maxLimit != null && minLimit.compareTo(maxLimit) > 0) {
+            baseDataValidator.reset().parameter(odMinLimitParamName).value(minLimit)
+                    .failWithCodeAndMessage("cannot.exceed.maximum.overdraft.limit", "Minimum OD limit cannot exceed the maximum OD limit.");
         }
-        if (this.fromApiJsonHelper.parameterExists(minOverdraftForInterestCalculationParamName, element)) {
+        baseDataValidator.reset().parameter(nominalAnnualInterestRateOverdraftParamName).value(rate).notNull().positiveAmount()
-            final BigDecimal minOverdraftForInterestCalculation = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(minOverdraftForInterestCalculationParamName, element);
+                .notGreaterThanMax(MAX_OVERDRAFT_RATE);
-            baseDataValidator.reset().parameter(minOverdraftForInterestCalculationParamName).value(minOverdraftForInterestCalculation).ignoreIfNull().zeroOrPositiveAmount();
+        baseDataValidator.reset().parameter(minOverdraftForInterestCalculationParamName).value(minOdForInterest).ignoreIfNull()
+                .zeroOrPositiveAmount();
+
+        final String validity = stringOrStored(element, validForPeriodParamName, product == null ? null : product.getValidForPeriod());
+        baseDataValidator.reset().parameter(validForPeriodParamName).value(validity).notBlank()
+                .isOneOfTheseStringValues(OD_VALIDITY_PERIODS);
+
+        final String securityType = stringOrStored(element, odSecurityTypeParamName,
+                product == null ? null : product.getOdSecurityType());
+        baseDataValidator.reset().parameter(odSecurityTypeParamName).value(securityType).notBlank()
+                .isOneOfTheseStringValues(OD_SECURITY_TYPES);
+
+        // Excess drawing past the sanctioned limit. Off means a withdrawal beyond the limit is refused. On, the
+        // excess is capped at a percentage of the limit and carries a penal charge on the excess alone -- a separate
+        // charge, as RBI's 2023 penal-charges directions require, not a higher rate on the whole balance.
+        final boolean excessAllowed = this.fromApiJsonHelper.parameterExists(odExcessAllowedParamName, element)
+                ? BooleanUtils.isTrue(this.fromApiJsonHelper.extractBooleanNamed(odExcessAllowedParamName, element))
+                : product != null && product.isOdExcessAllowed();
+        if (excessAllowed) {
+            final BigDecimal excessPercent = bigDecimalOrStored(element, odExcessLimitPercentParamName,
+                    product == null ? null : product.getOdExcessLimitPercent());
+            baseDataValidator.reset().parameter(odExcessLimitPercentParamName).value(excessPercent).notNull().positiveAmount()
+                    .notGreaterThanMax(MAX_EXCESS_PERCENT);
+            final BigDecimal penalRate = bigDecimalOrStored(element, odPenalRateParamName,
+                    product == null ? null : product.getOdPenalRate());
+            baseDataValidator.reset().parameter(odPenalRateParamName).value(penalRate).notNull().positiveAmount()
+                    .notGreaterThanMax(MAX_OVERDRAFT_RATE);
         }
+
+        final Integer postingPeriod = this.fromApiJsonHelper.parameterExists(interestPostingPeriodTypeParamName, element)
+                ? this.fromApiJsonHelper.extractIntegerSansLocaleNamed(interestPostingPeriodTypeParamName, element)
+                : product == null ? null : product.getInterestPostingPeriodType();
+        baseDataValidator.reset().parameter(interestPostingPeriodTypeParamName).value(postingPeriod).ignoreIfNull()
+                .isOneOfTheseValues(SavingsPostingInterestPeriodType.MONTHLY.getValue(),
+                        SavingsPostingInterestPeriodType.QUATERLY.getValue());
+
+        final Integer daysInYear = this.fromApiJsonHelper.parameterExists(interestCalculationDaysInYearTypeParamName, element)
+                ? this.fromApiJsonHelper.extractIntegerSansLocaleNamed(interestCalculationDaysInYearTypeParamName, element)
+                : product == null ? null : product.getInterestCalculationDaysInYearType();
+        baseDataValidator.reset().parameter(interestCalculationDaysInYearTypeParamName).value(daysInYear).ignoreIfNull()
+                .isOneOfTheseValues(SavingsInterestCalculationDaysInYearType.DAYS_360.getValue(),
+                        SavingsInterestCalculationDaysInYearType.DAYS_365.getValue());
+    }
+
+    private BigDecimal bigDecimalOrStored(final JsonElement element, final String paramName, final BigDecimal stored) {
+        return this.fromApiJsonHelper.parameterExists(paramName, element)
+                ? this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(paramName, element)
+                : stored;
+    }
+
+    private String stringOrStored(final JsonElement element, final String paramName, final String stored) {
+        return this.fromApiJsonHelper.parameterExists(paramName, element) ? this.fromApiJsonHelper.extractStringNamed(paramName, element)
+                : stored;
     }
 
     private void validateLienParams(final DataValidatorBuilder baseDataValidator, final JsonElement element) {
@@ -430,7 +526,7 @@ public class CurrentProductDataValidator {
                 && BooleanUtils.isTrue(this.fromApiJsonHelper.extractBooleanNamed(allowOverdraftParamName, element))) {
             final BigDecimal maxAllowedLienLimit = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(maxAllowedLienLimitParamName, element);
             final BigDecimal overdraftLimit = this.fromApiJsonHelper.extractBigDecimalWithLocaleNamed(overdraftLimitParamName, element);
-            if (overdraftLimit.compareTo(maxAllowedLienLimit) > 0) {
+            if (overdraftLimit != null && maxAllowedLienLimit != null && overdraftLimit.compareTo(maxAllowedLienLimit) > 0) {
                 baseDataValidator.reset().failWithCodeNoParameterAddedToErrorCode("Overdraft.limit.can.not.be.greater.than.lien.limit");
             }
         }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/domain/CurrentProduct.java

@@ -68,6 +68,11 @@ import static org.apache.fineract.portfolio.savings.SavingsApiConstants.autoDebi
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.avgBalanceCalcPeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.validForPeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odAccountClosedZeroBalanceInDayClosingParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odMinLimitParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odSecurityTypeParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odExcessAllowedParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odExcessLimitPercentParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odPenalRateParamName;
 
 import com.google.gson.JsonArray;
 import jakarta.persistence.CascadeType;
@@ -290,6 +295,25 @@ public class CurrentProduct extends AbstractPersistableCustom<Long> {
     @Column(name = "od_account_closed_zero_balance_in_day_closing")
     private boolean odAccountClosedZeroBalanceInDayClosing = false;
 
+    // The smallest limit an account on this scheme may be sanctioned; overdraftLimit is the largest.
+    @Column(name = "od_min_limit", scale = 6, precision = 19)
+    private BigDecimal odMinLimit;
+
+    // CLEAN, SECURED or BOTH: whether a sanction must be backed by security (FD lien, property...).
+    @Column(name = "od_security_type", length = 20)
+    private String odSecurityType;
+
+    // Excess drawing past the sanctioned limit: off means it is blocked. When on, odExcessLimitPercent caps the excess
+    // as a percentage of the limit and odPenalRate (% p.a.) is charged on the excess alone.
+    @Column(name = "od_excess_allowed")
+    private boolean odExcessAllowed = false;
+
+    @Column(name = "od_excess_limit_percent", scale = 6, precision = 19)
+    private BigDecimal odExcessLimitPercent;
+
+    @Column(name = "od_penal_rate", scale = 6, precision = 19)
+    private BigDecimal odPenalRate;
+
     @OneToOne(cascade = CascadeType.ALL, mappedBy = "currentProduct", orphanRemoval = true)
     private CurrentProductFacilityConfig facilityConfig;
 
@@ -804,11 +828,45 @@ public class CurrentProduct extends AbstractPersistableCustom<Long> {
             actualChanges.put(odAccountClosedZeroBalanceInDayClosingParamName, newValue);
             this.odAccountClosedZeroBalanceInDayClosing = newValue;
         }
+        if (command.isChangeInBigDecimalParameterNamedDefaultingZeroToNull(odMinLimitParamName, this.odMinLimit)) {
+            final BigDecimal newValue = command.bigDecimalValueOfParameterNamedDefaultToNullIfZero(odMinLimitParamName);
+            actualChanges.put(odMinLimitParamName, newValue);
+            this.odMinLimit = newValue;
+        }
+        if (command.isChangeInStringParameterNamed(odSecurityTypeParamName, this.odSecurityType)) {
+            final String newValue = command.stringValueOfParameterNamed(odSecurityTypeParamName);
+            actualChanges.put(odSecurityTypeParamName, newValue);
+            this.odSecurityType = newValue;
+        }
+        if (command.isChangeInBooleanParameterNamed(odExcessAllowedParamName, this.odExcessAllowed)) {
+            final boolean newValue = command.booleanPrimitiveValueOfParameterNamed(odExcessAllowedParamName);
+            actualChanges.put(odExcessAllowedParamName, newValue);
+            this.odExcessAllowed = newValue;
+        }
+        if (command.isChangeInBigDecimalParameterNamedDefaultingZeroToNull(odExcessLimitPercentParamName, this.odExcessLimitPercent)) {
+            final BigDecimal newValue = command.bigDecimalValueOfParameterNamedDefaultToNullIfZero(odExcessLimitPercentParamName);
+            actualChanges.put(odExcessLimitPercentParamName, newValue);
+            this.odExcessLimitPercent = newValue;
+        }
+        if (command.isChangeInBigDecimalParameterNamedDefaultingZeroToNull(odPenalRateParamName, this.odPenalRate)) {
+            final BigDecimal newValue = command.bigDecimalValueOfParameterNamedDefaultToNullIfZero(odPenalRateParamName);
+            actualChanges.put(odPenalRateParamName, newValue);
+            this.odPenalRate = newValue;
+        }
+        if (!this.odExcessAllowed) {
+            this.odExcessLimitPercent = null;
+            this.odPenalRate = null;
+        }
         // Clear OD-specific fields when overdraft is disabled
         if (!this.allowOverdraft) {
             this.avgBalanceCalcPeriod = null;
             this.validForPeriod = null;
             this.odAccountClosedZeroBalanceInDayClosing = false;
+            this.odMinLimit = null;
+            this.odSecurityType = null;
+            this.odExcessAllowed = false;
+            this.odExcessLimitPercent = null;
+            this.odPenalRate = null;
         }
 
         return actualChanges;
@@ -890,4 +948,14 @@ public class CurrentProduct extends AbstractPersistableCustom<Long> {
     public void setValidForPeriod(String validForPeriod) { this.validForPeriod = validForPeriod; }
     public boolean isOdAccountClosedZeroBalanceInDayClosing() { return odAccountClosedZeroBalanceInDayClosing; }
     public void setOdAccountClosedZeroBalanceInDayClosing(boolean val) { this.odAccountClosedZeroBalanceInDayClosing = val; }
+    public BigDecimal getOdMinLimit() { return odMinLimit; }
+    public void setOdMinLimit(BigDecimal odMinLimit) { this.odMinLimit = odMinLimit; }
+    public String getOdSecurityType() { return odSecurityType; }
+    public void setOdSecurityType(String odSecurityType) { this.odSecurityType = odSecurityType; }
+    public boolean isOdExcessAllowed() { return odExcessAllowed; }
+    public void setOdExcessAllowed(boolean odExcessAllowed) { this.odExcessAllowed = odExcessAllowed; }
+    public BigDecimal getOdExcessLimitPercent() { return odExcessLimitPercent; }
+    public void setOdExcessLimitPercent(BigDecimal odExcessLimitPercent) { this.odExcessLimitPercent = odExcessLimitPercent; }
+    public BigDecimal getOdPenalRate() { return odPenalRate; }
+    public void setOdPenalRate(BigDecimal odPenalRate) { this.odPenalRate = odPenalRate; }
 }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/domain/CurrentProductAssembler.java

@@ -43,6 +43,11 @@ import static org.apache.fineract.portfolio.savings.SavingsApiConstants.autoDebi
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.avgBalanceCalcPeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.validForPeriodParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odAccountClosedZeroBalanceInDayClosingParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odMinLimitParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odSecurityTypeParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odExcessAllowedParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odExcessLimitPercentParamName;
+import static org.apache.fineract.portfolio.savings.SavingsApiConstants.odPenalRateParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.endDateParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.enforceMinRequiredBalanceParamName;
 import static org.apache.fineract.portfolio.savings.SavingsApiConstants.frequencyFixDayParamName;
@@ -314,6 +319,23 @@ public class CurrentProductAssembler {
             if (command.parameterExists(odAccountClosedZeroBalanceInDayClosingParamName)) {
                 product.setOdAccountClosedZeroBalanceInDayClosing(command.booleanPrimitiveValueOfParameterNamed(odAccountClosedZeroBalanceInDayClosingParamName));
             }
+            if (command.parameterExists(odMinLimitParamName)) {
+                product.setOdMinLimit(command.bigDecimalValueOfParameterNamed(odMinLimitParamName));
+            }
+            if (command.parameterExists(odSecurityTypeParamName)) {
+                product.setOdSecurityType(command.stringValueOfParameterNamed(odSecurityTypeParamName));
+            }
+            final boolean excessAllowed = command.parameterExists(odExcessAllowedParamName)
+                    && command.booleanPrimitiveValueOfParameterNamed(odExcessAllowedParamName);
+            product.setOdExcessAllowed(excessAllowed);
+            if (excessAllowed) {
+                if (command.parameterExists(odExcessLimitPercentParamName)) {
+                    product.setOdExcessLimitPercent(command.bigDecimalValueOfParameterNamed(odExcessLimitPercentParamName));
+                }
+                if (command.parameterExists(odPenalRateParamName)) {
+                    product.setOdPenalRate(command.bigDecimalValueOfParameterNamed(odPenalRateParamName));
+                }
+            }
         }
 
         return product;

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductGlMappingWriter.java

@@ -0,0 +1,115 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.currentproduct.service;
+
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.accounting.common.AccountingConstants.SavingProductAccountingParams;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.portfolio.PortfolioProductType;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Writes a current product's GL mappings to acc_product_mapping under {@link PortfolioProductType#CURRENT}.
+ *
+ * <p>
+ * They used to be written by the savings mapping writer under SAVING, keyed only by product id, so a current product
+ * and a savings product with the same id shared rows: two Current Control rows came back for one lookup and the
+ * account's GL posting failed outright, leaving the balance moved with no journal entry. Written under their own type,
+ * the two can never meet.
+ *
+ * <p>
+ * A parameter present in the request replaces that one mapping (null clears it); an absent one is left alone, so a
+ * partial edit changes only what it names. Accounting rule NONE clears every mapping.
+ */
+@Component
+@RequiredArgsConstructor
+public class CurrentProductGlMappingWriter {
+
+    /** Request parameter -> financial account type (CashAccountsForSavings / AccrualAccountsForSavings). */
+    private static final Map<String, Integer> PARAM_TO_FINANCIAL_TYPE = new LinkedHashMap<>();
+
+    static {
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.SAVINGS_REFERENCE.getValue(), 1);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.SAVINGS_CONTROL.getValue(), 2);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.INTEREST_ON_SAVINGS.getValue(), 3);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.INCOME_FROM_FEES.getValue(), 4);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.INCOME_FROM_PENALTIES.getValue(), 5);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.TRANSFERS_SUSPENSE.getValue(), 10);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.OVERDRAFT_PORTFOLIO_CONTROL.getValue(), 11);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.INCOME_FROM_INTEREST.getValue(), 12);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.LOSSES_WRITTEN_OFF.getValue(), 13);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.ESCHEAT_LIABILITY.getValue(), 14);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.FEES_RECEIVABLE.getValue(), 15);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.PENALTIES_RECEIVABLE.getValue(), 16);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.INTEREST_PAYABLE.getValue(), 17);
+        PARAM_TO_FINANCIAL_TYPE.put(SavingProductAccountingParams.INTEREST_RECEIVABLE.getValue(), 18);
+    }
+
+    private static final int CURRENT = PortfolioProductType.CURRENT.getValue();
+
+    private final JdbcTemplate jdbcTemplate;
+
+    /**
+     * Applies the request's mappings to the product and returns what changed, keyed by parameter name.
+     *
+     * @param accountingRule
+     *            the product's accounting rule after this request (1 = NONE)
+     */
+    public Map<String, Object> write(final Long productId, final JsonCommand command, final Integer accountingRule) {
+        final Map<String, Object> changes = new LinkedHashMap<>();
+        if (accountingRule == null || accountingRule == 1) {
+            jdbcTemplate.update("DELETE FROM acc_product_mapping WHERE product_type = ? AND product_id = ?", CURRENT, productId);
+            return changes;
+        }
+        final JsonElement parsed = command.parsedJson();
+        final JsonObject json = parsed != null && parsed.isJsonObject() ? parsed.getAsJsonObject() : new JsonObject();
+        for (final Map.Entry<String, Integer> entry : PARAM_TO_FINANCIAL_TYPE.entrySet()) {
+            final String param = entry.getKey();
+            if (!json.has(param)) {
+                continue;
+            }
+            final Long glAccountId = json.get(param).isJsonNull() ? null : json.get(param).getAsLong();
+            final Long existing = jdbcTemplate.queryForList(
+                    "SELECT gl_account_id FROM acc_product_mapping WHERE product_type = ? AND product_id = ? AND financial_account_type = ?"
+                            + " AND payment_type IS NULL AND charge_id IS NULL",
+                    Long.class, CURRENT, productId, entry.getValue()).stream().findFirst().orElse(null);
+            if (java.util.Objects.equals(existing, glAccountId)) {
+                continue;
+            }
+            jdbcTemplate.update("DELETE FROM acc_product_mapping WHERE product_type = ? AND product_id = ? AND financial_account_type = ?"
+                    + " AND payment_type IS NULL AND charge_id IS NULL", CURRENT, productId, entry.getValue());
+            if (glAccountId != null) {
+                jdbcTemplate.update("INSERT INTO acc_product_mapping (gl_account_id, product_id, product_type, financial_account_type)"
+                        + " VALUES (?, ?, ?, ?)", glAccountId, productId, CURRENT, entry.getValue());
+            }
+            changes.put(param, glAccountId);
+        }
+        return changes;
+    }
+
+    /** Removes every mapping of a deleted product. */
+    public void deleteAll(final Long productId) {
+        jdbcTemplate.update("DELETE FROM acc_product_mapping WHERE product_type = ? AND product_id = ?", CURRENT, productId);
+    }
+}

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductReadPlatformServiceImpl.java

@@ -268,6 +268,9 @@ public class CurrentProductReadPlatformServiceImpl implements CurrentProductRead
             sqlBuilder.append("cp.balance_swap_option as balanceSwapOption, cp.msme as msme, cp.auto_debit_facility as autoDebitFacility, ");
             sqlBuilder.append("cp.avg_balance_calc_period as avgBalanceCalcPeriod, cp.valid_for_period as validForPeriod, ");
             sqlBuilder.append("cp.od_account_closed_zero_balance_in_day_closing as odAccountClosedZeroBalanceInDayClosing, ");
+            sqlBuilder.append("cp.od_min_limit as odMinLimit, cp.od_security_type as odSecurityType, ");
+            sqlBuilder.append("cp.od_excess_allowed as odExcessAllowed, cp.od_excess_limit_percent as odExcessLimitPercent, ");
+            sqlBuilder.append("cp.od_penal_rate as odPenalRate, ");
             sqlBuilder.append("exists(select 1 from m_saving_product_temp spt where spt.product_id = cp.id "
                     + "and spt.product_type = 'CURRENT' and spt.status = 'PENDING') as isPendingApproval ");
 
@@ -393,6 +396,11 @@ public class CurrentProductReadPlatformServiceImpl implements CurrentProductRead
             productData.setAvgBalanceCalcPeriod(rs.getString("avgBalanceCalcPeriod"));
             productData.setValidForPeriod(rs.getString("validForPeriod"));
             productData.setOdAccountClosedZeroBalanceInDayClosing(rs.getBoolean("odAccountClosedZeroBalanceInDayClosing"));
+            productData.setOdMinLimit(rs.getBigDecimal("odMinLimit"));
+            productData.setOdSecurityType(rs.getString("odSecurityType"));
+            productData.setOdExcessAllowed(rs.getBoolean("odExcessAllowed"));
+            productData.setOdExcessLimitPercent(rs.getBigDecimal("odExcessLimitPercent"));
+            productData.setOdPenalRate(rs.getBigDecimal("odPenalRate"));
             productData.setIsPendingApproval(rs.getBoolean("isPendingApproval"));
 
             return productData;

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductWritePlatformServiceJpaRepositoryImpl.java

@@ -98,6 +98,7 @@ public class CurrentProductWritePlatformServiceJpaRepositoryImpl implements Curr
     private final ProductPendingEditGlMappingRepository pendingEditGlMappingRepository;
     private final FromJsonHelper fromApiJsonHelper;
     private final CommandSourceRepository commandSourceRepository;
+    private final CurrentProductGlMappingWriter glMappingWriter;
 
     private void handleDataIntegrityIssues(final JsonCommand command, final Throwable realCause, final Exception dae) {
         String msgCode = "error.msg." + DepositsApiConstants.CURRENT_PRODUCT_RESOURCE_NAME;
@@ -161,8 +162,8 @@ public class CurrentProductWritePlatformServiceJpaRepositoryImpl implements Curr
                 this.depositLimitKycRepository.saveAndFlush(depositLimitKyc);
             }
 
-            this.accountMappingWritePlatformService.createSavingProductToGLAccountMapping(product.getId(), command,
+            // Under the product's own CURRENT type, never SAVING: see CurrentProductGlMappingWriter.
-                    DepositAccountType.SAVINGS_DEPOSIT);
+            this.glMappingWriter.write(product.getId(), command, product.getAccountingType());
 
             return new CommandProcessingResultBuilder() //
                     .withEntityId(product.getId()) //
@@ -258,10 +259,8 @@ public class CurrentProductWritePlatformServiceJpaRepositoryImpl implements Curr
             }
 
             // accounting related changes
-            final boolean accountingTypeChanged = changes.containsKey(accountingRuleParamName);
+            final Map<String, Object> accountingMappingChanges = this.glMappingWriter.write(product.getId(), command,
-            final Map<String, Object> accountingMappingChanges = this.accountMappingWritePlatformService
+                    product.getAccountingType());
-                    .updateSavingsProductToGLAccountMapping(product.getId(), command, accountingTypeChanged, product.getAccountingType(),
-                            DepositAccountType.SAVINGS_DEPOSIT);
             changes.putAll(accountingMappingChanges);
 
             if (!changes.isEmpty()) {
@@ -504,6 +503,7 @@ public class CurrentProductWritePlatformServiceJpaRepositoryImpl implements Curr
                 .orElseThrow(() -> new SavingsProductNotFoundException(productId));
 
         this.currentProductRepository.delete(product);
+        this.glMappingWriter.deleteAll(productId);
 
         return new CommandProcessingResultBuilder() //
                 .withEntityId(product.getId()) //

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/starter/CurrentProductConfiguration.java

@@ -33,6 +33,7 @@ import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductDeposit
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityConfigRepository;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityLimitRepository;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductRepository;
+import org.apache.fineract.portfolio.currentproduct.service.CurrentProductGlMappingWriter;
 import org.apache.fineract.portfolio.currentproduct.service.CurrentProductReadPlatformService;
 import org.apache.fineract.portfolio.currentproduct.service.CurrentProductReadPlatformServiceImpl;
 import org.apache.fineract.portfolio.currentproduct.service.CurrentProductWritePlatformService;
@@ -78,11 +79,11 @@ public class CurrentProductConfiguration {
             ProductPendingEditFacilityLimitRepository pendingEditFacilityLimitRepository,
             ProductPendingEditGlMappingRepository pendingEditGlMappingRepository,
             FromJsonHelper fromApiJsonHelper,
-            CommandSourceRepository commandSourceRepository) {
+            CommandSourceRepository commandSourceRepository, CurrentProductGlMappingWriter glMappingWriter) {
         return new CurrentProductWritePlatformServiceJpaRepositoryImpl(context, currentProductRepository, currentProductDataValidator,
                 currentProductAssembler, accountMappingWritePlatformService, currentFacilityConfigRepository,
                 currentFacilityLimitRepository, currentDepositLimitKycRepository, productPendingEditRepository,
                 pendingEditSubmittedFieldRepository, pendingEditChargeRepository, pendingEditFacilityLimitRepository,
-                pendingEditGlMappingRepository, fromApiJsonHelper, commandSourceRepository);
+                pendingEditGlMappingRepository, fromApiJsonHelper, commandSourceRepository, glMappingWriter);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/accounting/balancesheet/api/BalanceSheetApiResource.java

@@ -0,0 +1,243 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.balancesheet.api;
+
+import com.google.gson.Gson;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * An "as on date" balance sheet built directly off the live chart of accounts and journal entries,
+ * rather than a stock Fineract trial balance report — this reproduces the specific sub-group-wise
+ * layout this bank's own paper balance sheet uses: every top-level Header account (Capital, Deposit
+ * Account, Other Liabilities, ...) is one named block, with its Detail (and any nested Header)
+ * children indented underneath it and a subtotal on the block itself. A Detail account with no
+ * Header at all (see GLAccountTransactionGuard's sibling concern - some accounts are seeded standalone)
+ * still needs to appear somewhere, so it is listed as its own root-level line rather than silently
+ * dropped.
+ *
+ * A Header account never itself carries a journal entry (see the header/detail discussion this
+ * feature grew out of), so its balance is always the recursive sum of its children - never read off
+ * acc_gl_journal_entry directly.
+ */
+@Path("/v1/accounting/balancesheet")
+@Component
+@RequiredArgsConstructor
+@Produces({ MediaType.APPLICATION_JSON })
+public class BalanceSheetApiResource {
+
+    private static final String RESOURCE_NAME_FOR_PERMISSION = "GLACCOUNT";
+
+    private final PlatformSecurityContext context;
+    private final JdbcTemplate jdbcTemplate;
+    private final Gson gson = new Gson();
+
+    // classification_enum values (see acc_gl_account / GLAccountType).
+    private static final int ASSET = 1;
+    private static final int LIABILITY = 2;
+    private static final int EQUITY = 3;
+    private static final int INCOME = 4;
+    private static final int EXPENSE = 5;
+    // account_usage values (see GLAccountUsage).
+    private static final int DETAIL = 1;
+    private static final int HEADER = 2;
+
+    private static final class Node {
+
+        Long id;
+        String name;
+        String glCode;
+        int usage;
+        int classification;
+        Long parentId;
+        BigDecimal ownBalance = BigDecimal.ZERO;
+        final List<Node> children = new ArrayList<>();
+
+        BigDecimal balance() {
+            if (usage == DETAIL) {
+                return ownBalance;
+            }
+            BigDecimal sum = BigDecimal.ZERO;
+            for (final Node child : children) {
+                sum = sum.add(child.balance());
+            }
+            return sum;
+        }
+
+        Map<String, Object> toJson() {
+            final Map<String, Object> json = new LinkedHashMap<>();
+            json.put("id", id);
+            json.put("name", name);
+            json.put("glCode", glCode);
+            json.put("usage", usage == HEADER ? "HEADER" : "DETAIL");
+            json.put("balance", balance());
+            final List<Map<String, Object>> childJson = new ArrayList<>();
+            for (final Node child : children) {
+                childJson.add(child.toJson());
+            }
+            json.put("children", childJson);
+            return json;
+        }
+    }
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    public String retrieveBalanceSheet(@QueryParam("asOnDate") final String asOnDateParam,
+            @QueryParam("officeId") final Long officeId) {
+        this.context.authenticatedUser().validateHasReadPermission(RESOURCE_NAME_FOR_PERMISSION);
+
+        final LocalDate asOnDate = (asOnDateParam == null || asOnDateParam.isBlank()) ? DateUtils.getBusinessLocalDate()
+                : LocalDate.parse(asOnDateParam);
+
+        final Map<Long, Node> nodesById = new LinkedHashMap<>();
+        for (final Map<String, Object> row : this.jdbcTemplate.queryForList(
+                "SELECT id, name, gl_code, parent_id, account_usage, classification_enum FROM acc_gl_account "
+                        + "WHERE disabled = false ORDER BY gl_code")) {
+            final Node node = new Node();
+            node.id = ((Number) row.get("id")).longValue();
+            node.name = (String) row.get("name");
+            node.glCode = (String) row.get("gl_code");
+            node.parentId = row.get("parent_id") == null ? null : ((Number) row.get("parent_id")).longValue();
+            node.usage = ((Number) row.get("account_usage")).intValue();
+            node.classification = ((Number) row.get("classification_enum")).intValue();
+            nodesById.put(node.id, node);
+        }
+
+        // entry_date (not transaction_date) and "reversed = false" are this codebase's settled
+        // convention for reading balances off the ledger - ProfitAndLossApiResource, the dividend
+        // reports and IncomeProfitTransferService all cut the same way, so this report agrees with
+        // them rather than quietly producing a second set of numbers.
+        //
+        // The reversal_id exclusion covers a case that plain "reversed = false" gets wrong. This
+        // codebase reverses in two different ways: the clerk/sponsor-DD undo paths just flip the
+        // flag on the original leg (no counter entry - excluding it is exactly right), while
+        // Fineract's own revertJournalEntry additionally posts an opposite-sign counter entry and
+        // links it back through reversal_id. For that second kind, dropping only the original would
+        // leave its counter entry standing alone and swing the balance by the full amount in the
+        // wrong direction, so the counter entry has to go too.
+        final Map<Long, BigDecimal[]> balances = new LinkedHashMap<>();
+        final String balanceSql = "SELECT account_id, "
+                + "COALESCE(SUM(CASE WHEN type_enum = 2 THEN amount ELSE 0 END), 0) AS total_debit, "
+                + "COALESCE(SUM(CASE WHEN type_enum = 1 THEN amount ELSE 0 END), 0) AS total_credit "
+                + "FROM acc_gl_journal_entry WHERE entry_date <= ? "
+                + "AND (reversed IS NULL OR reversed = false) "
+                + "AND id NOT IN (SELECT reversal_id FROM acc_gl_journal_entry WHERE reversal_id IS NOT NULL)"
+                + (officeId != null ? " AND office_id = ?" : "") + " GROUP BY account_id";
+        final List<Map<String, Object>> balanceRows = officeId != null
+                ? this.jdbcTemplate.queryForList(balanceSql, java.sql.Date.valueOf(asOnDate), officeId)
+                : this.jdbcTemplate.queryForList(balanceSql, java.sql.Date.valueOf(asOnDate));
+        for (final Map<String, Object> row : balanceRows) {
+            balances.put(((Number) row.get("account_id")).longValue(),
+                    new BigDecimal[] { (BigDecimal) row.get("total_debit"), (BigDecimal) row.get("total_credit") });
+        }
+
+        for (final Node node : nodesById.values()) {
+            if (node.usage != DETAIL) {
+                continue;
+            }
+            final BigDecimal[] debitCredit = balances.get(node.id);
+            if (debitCredit == null) {
+                continue;
+            }
+            final boolean debitNatured = node.classification == ASSET || node.classification == EXPENSE;
+            node.ownBalance = debitNatured ? debitCredit[0].subtract(debitCredit[1]) : debitCredit[1].subtract(debitCredit[0]);
+        }
+
+        final List<Node> roots = new ArrayList<>();
+        for (final Node node : nodesById.values()) {
+            if (node.parentId == null) {
+                roots.add(node);
+            } else {
+                final Node parent = nodesById.get(node.parentId);
+                if (parent != null) {
+                    parent.children.add(node);
+                } else {
+                    // Parent was disabled (filtered out above) - surface this node at the top level
+                    // rather than silently losing its balance from the report.
+                    roots.add(node);
+                }
+            }
+        }
+
+        final Map<String, Object> debitSide = buildSide("ASSETS", roots, ASSET, EXPENSE);
+        final Map<String, Object> creditSide = buildSide("LIABILITIES", roots, LIABILITY, EQUITY, INCOME);
+
+        final Map<String, Object> response = new LinkedHashMap<>();
+        response.put("asOnDate", asOnDate.toString());
+        response.put("officeId", officeId);
+        response.put("debitSide", debitSide);
+        response.put("creditSide", creditSide);
+        return this.gson.toJson(response);
+    }
+
+    private Map<String, Object> buildSide(final String label, final List<Node> roots, final int... classifications) {
+        final List<Map<String, Object>> groups = new ArrayList<>();
+        BigDecimal sideTotal = BigDecimal.ZERO;
+        for (final int classification : classifications) {
+            final List<Map<String, Object>> nodeJsons = new ArrayList<>();
+            BigDecimal groupTotal = BigDecimal.ZERO;
+            for (final Node root : roots) {
+                if (root.classification != classification) {
+                    continue;
+                }
+                nodeJsons.add(root.toJson());
+                groupTotal = groupTotal.add(root.balance());
+            }
+            if (!nodeJsons.isEmpty()) {
+                final Map<String, Object> group = new LinkedHashMap<>();
+                group.put("classification", classificationLabel(classification));
+                group.put("total", groupTotal);
+                group.put("nodes", nodeJsons);
+                groups.add(group);
+                sideTotal = sideTotal.add(groupTotal);
+            }
+        }
+        final Map<String, Object> side = new LinkedHashMap<>();
+        side.put("label", label);
+        side.put("total", sideTotal);
+        side.put("groups", groups);
+        return side;
+    }
+
+    private String classificationLabel(final int classification) {
+        return switch (classification) {
+            case ASSET -> "ASSET";
+            case LIABILITY -> "LIABILITY";
+            case EQUITY -> "EQUITY";
+            case INCOME -> "INCOME";
+            case EXPENSE -> "EXPENSE";
+            default -> "OTHER";
+        };
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/common/DividendGlAccountResolver.java

@@ -0,0 +1,112 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.common;
+
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.accounting.common.AccountingConstants.FinancialActivity;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+
+/**
+ * Resolves the GL accounts the dividend lifecycle posts to, from the Financial Activity Mappings an administrator
+ * configures.
+ *
+ * <p>
+ * These accounts used to be found by hardcoded GL code - {@code BANKPROFITND01} and {@code BANKPROFIT01} - spread
+ * across five classes. A society whose chart of accounts did not happen to use those exact codes got no dividend
+ * journal entries at all, and nothing said so: every call site checked for null and returned quietly. Reading them from
+ * the mapping table instead lets each society name its own accounts, and keeps the whole lifecycle answerable from one
+ * screen.
+ *
+ * <p>
+ * Resolution is mapping-only, with no fallback to the old codes: a society that has not mapped an account has not made
+ * the decision yet, and quietly posting to an account it never chose is worse than refusing. Every method here throws
+ * rather than returning null, so a missing mapping surfaces at the point of posting with the name of the activity to
+ * configure, instead of leaving a declaration that appears to have worked but moved nothing.
+ */
+@Service
+@RequiredArgsConstructor
+public class DividendGlAccountResolver {
+
+    private final JdbcTemplate jdbcTemplate;
+
+    /** The year's closed-out profit a dividend is declared against. */
+    public Long distributableProfitAccount() {
+        return requireMapped(FinancialActivity.DISTRIBUTABLE_PROFIT);
+    }
+
+    /** Where profit settles once it is no longer distributable: the undistributed remainder, rounding, forfeitures. */
+    public Long retainedProfitAccount() {
+        return requireMapped(FinancialActivity.RETAINED_PROFIT);
+    }
+
+    /** Equity the declared profit is set aside in, between declaration and board approval. */
+    public Long reserveForDividendAccount() {
+        return requireMapped(FinancialActivity.RESERVE_FOR_DIVIDEND);
+    }
+
+    /** The liability to members, created on approval and discharged as each member claims. */
+    public Long payableDividendsAccount() {
+        return requireMapped(FinancialActivity.PAYABLE_DIVIDENDS);
+    }
+
+    /**
+     * Where the paise a dividend cannot divide evenly are swept.
+     *
+     * Falls back to retained profit when unmapped, which is exactly where the residue went before this account existed
+     * - so a society that does not care to separate it keeps the behaviour it already had, and one that maps it gets
+     * the arithmetic artefact out of a figure it reads as a business result. This is a presentation choice rather than
+     * a decision the society has failed to make, which is why it resolves rather than throwing.
+     */
+    public Long dividendRoundOffAccount() {
+        final Long roundOff = mappedAccount(FinancialActivity.DIVIDEND_ROUND_OFF);
+        return roundOff != null ? roundOff : retainedProfitAccount();
+    }
+
+    /**
+     * Contra the claim is routed through, so claimed and unclaimed read as two balances rather than one net figure.
+     *
+     * Optional by design - a society that has not mapped it still gets a correct payout, posted straight from Dividend
+     * Payable, just without that separate measure. This is the one account here that may legitimately be absent, so it
+     * returns null instead of throwing.
+     */
+    public Long dividendPaidAccountOrNull() {
+        return mappedAccount(FinancialActivity.DIVIDEND_PAID);
+    }
+
+    /** The GL mapped to an activity, or null when the society has not configured it. */
+    public Long mappedAccount(final FinancialActivity activity) {
+        return this.jdbcTemplate
+                .queryForList("SELECT gl_account_id FROM acc_gl_financial_activity_account WHERE financial_activity_type = ?", Long.class,
+                        activity.getValue())
+                .stream().findFirst().orElse(null);
+    }
+
+    private Long requireMapped(final FinancialActivity activity) {
+        final Long glAccountId = mappedAccount(activity);
+        if (glAccountId == null) {
+            throw new GeneralPlatformDomainRuleException("error.msg.financial.activity.mapping." + activity.getCode() + ".not.configured",
+                    "No GL account is mapped to the '" + activity + "' financial activity. Map one under Accounting > Financial Activity "
+                            + "Mappings before running the dividend cycle.",
+                    activity.getValue());
+        }
+        return glAccountId;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/glaccount/validation/GLAccountTransactionGuard.java

@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.glaccount.validation;
+
+import org.apache.fineract.accounting.glaccount.domain.GLAccountUsage;
+import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
+import org.springframework.dao.EmptyResultDataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+/**
+ * A Header GL account (account_usage = HEADER) is a pure grouping node in the chart-of-accounts tree - it
+ * exists to organize Detail accounts underneath it, never to receive a transaction itself. The standard
+ * Fineract journal-entry command path (JournalEntryWritePlatformServiceJpaRepositoryImpl) never checked
+ * this - only "disabled" and "manual entries allowed" - and several features in this codebase post journal
+ * entries via direct JDBC INSERT into acc_gl_journal_entry, bypassing that command path entirely. This is
+ * the one shared check every such call site uses so a Header account can never end up with its own
+ * transaction (which would silently break every report that assumes a Header's balance is just the sum of
+ * its Detail children).
+ */
+public final class GLAccountTransactionGuard {
+
+    private GLAccountTransactionGuard() {}
+
+    public static void assertPostable(final JdbcTemplate jdbcTemplate, final Long glAccountId) {
+        if (glAccountId == null) {
+            return;
+        }
+        final Integer usage;
+        try {
+            usage = jdbcTemplate.queryForObject("SELECT account_usage FROM acc_gl_account WHERE id = ?", Integer.class, glAccountId);
+        } catch (final EmptyResultDataAccessException e) {
+            throw new PlatformDataIntegrityException("error.msg.glaccount.not.found",
+                    "GL account with id " + glAccountId + " does not exist.", "glAccountId", glAccountId);
+        }
+        if (GLAccountUsage.HEADER.getValue().equals(usage)) {
+            throw new PlatformDataIntegrityException("error.msg.glaccount.header.account.not.postable",
+                    "GL account " + glAccountId + " is a Header account (a chart-of-accounts grouping node) and cannot receive a "
+                            + "transaction directly. Select a Detail account instead.",
+                    "glAccountId", glAccountId);
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/AccountingProcessorHelper.java

@@ -25,12 +25,14 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import lombok.RequiredArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.accounting.closure.domain.GLClosure;
 import org.apache.fineract.accounting.closure.domain.GLClosureRepository;
 import org.apache.fineract.accounting.common.AccountingConstants;
 import org.apache.fineract.accounting.common.AccountingConstants.AccrualAccountsForLoan;
+import org.apache.fineract.accounting.common.AccountingConstants.AccrualAccountsForSavings;
 import org.apache.fineract.accounting.common.AccountingConstants.CashAccountsForLoan;
 import org.apache.fineract.accounting.common.AccountingConstants.CashAccountsForSavings;
 import org.apache.fineract.accounting.common.AccountingConstants.CashAccountsForShares;
@@ -66,6 +68,7 @@ import org.apache.fineract.infrastructure.event.business.domain.journalentry.Loa
 import org.apache.fineract.infrastructure.event.business.service.BusinessEventNotifierService;
 import org.apache.fineract.organisation.office.domain.Office;
 import org.apache.fineract.organisation.office.domain.OfficeRepository;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
 import org.apache.fineract.portfolio.PortfolioProductType;
 import org.apache.fineract.portfolio.account.PortfolioAccountType;
 import org.apache.fineract.portfolio.account.service.AccountTransfersReadPlatformService;
@@ -77,6 +80,7 @@ import org.apache.fineract.portfolio.loanaccount.data.LoanTransactionEnumData;
 import org.apache.fineract.portfolio.savings.data.SavingsAccountTransactionEnumData;
 import org.apache.fineract.portfolio.shareaccounts.data.ShareAccountTransactionEnumData;
 import org.springframework.dao.DataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
 
 @RequiredArgsConstructor
 public class AccountingProcessorHelper {
@@ -89,6 +93,14 @@ public class AccountingProcessorHelper {
     public static final String PROVISIONING_TRANSACTION_IDENTIFIER = "P";
     public static final String SHARE_TRANSACTION_IDENTIFIER = "SH";
 
+    /**
+     * Reserved names on the savings product's Accounting tab, naming the two accounts an interest
+     * posting is routed through. The names are the contract with the product screen; the GL codes
+     * behind them are the bank's choice, so no code is named here.
+     */
+    public static final String SAVINGS_INTEREST_PAYABLE_MAPPING = "Savings Interest Payable";
+    public static final String SAVINGS_INTEREST_PAID_MAPPING = "Savings Interest Paid";
+
     private static final ThreadLocal<Integer> DEPOSIT_ACCOUNT_TYPE_CONTEXT = ThreadLocal.withInitial(() -> 100);
 
     public static void setDepositAccountTypeContext(int depositAccountType) {
@@ -116,6 +128,10 @@ public class AccountingProcessorHelper {
     private final AccountTransfersReadPlatformService accountTransfersReadPlatformService;
     private final ChargeRepositoryWrapper chargeRepositoryWrapper;
     private final BusinessEventNotifierService businessEventNotifierService;
+    // The savings interest payable/paid accounts live in m_savings_product.other_gl_mappings as a
+    // JSON document rather than in acc_product_mapping, so they are read directly. See
+    // namedSavingsGlAccount.
+    private final JdbcTemplate jdbcTemplate;
 
     public LoanDTO populateLoanDtoFromDTO(
             final org.apache.fineract.portfolio.loanaccount.data.AccountingBridgeDataDTO accountingBridgeData) {
@@ -600,6 +616,153 @@ public class AccountingProcessorHelper {
         createCreditJournalEntryForSavings(office, currencyCode, creditAccount, savingsId, transactionId, transactionDate, amount);
     }
 
+    /**
+     * Interest credited to a member, routed through the payable and paid accounts the product names.
+     *
+     * <pre>
+     *   Dr  Interest On Savings        (expense)     the bank incurs the cost
+     *   Cr  Savings Interest Payable   (liability)   and now owes it
+     *
+     *   Dr  Savings Interest Payable
+     *   Cr  Savings Interest Paid                    the debt is on its way out
+     *
+     *   Dr  Savings Interest Paid
+     *   Cr  Savings Control                          and reaches the member
+     * </pre>
+     *
+     * <p>
+     * The two middle accounts net to nil across the three steps, so the trial balance is unchanged
+     * from the plain two-legged entry; what they add is a reading of how much interest has been
+     * declared but not yet credited, which a single Dr/Cr pair cannot show.
+     *
+     * <p>
+     * Both are read from the product's Accounting tab and neither is required. A product that names
+     * no paid account collapses the middle step, and one that names no payable falls back to its own
+     * Savings Control - either way the posting degrades to exactly the two-legged entry it was
+     * before, so products configured before these mappings existed are unaffected.
+     *
+     * <p>
+     * Reversals swap every leg, the same way {@code createCashBasedJournalEntriesAndReversalsForSavings}
+     * does for the two-legged case.
+     */
+    public void createInterestPostingJournalEntriesForSavings(final Office office, final String currencyCode,
+            final Long savingsProductId, final Long paymentTypeId, final Long savingsId, final String transactionId,
+            final LocalDate transactionDate, final BigDecimal amount, final boolean isReversal) {
+
+        final GLAccount controlAccount = getLinkedGLAccountForSavingsProduct(savingsProductId,
+                CashAccountsForSavings.SAVINGS_CONTROL.getValue(), paymentTypeId);
+        final GLAccount interestOnSavingsAccount = getLinkedGLAccountForSavingsProduct(savingsProductId,
+                CashAccountsForSavings.INTEREST_ON_SAVINGS.getValue(), paymentTypeId);
+
+        // The payable comes from the Interest Payable row on the product's Accounting tab, which is
+        // where a bank actually picks it. The reserved name in the product's other GL mappings is
+        // consulted only after that, for a product configured before that row was mapped, and the
+        // Savings Control last of all - interest owed is a liability either way.
+        final GLAccount payableAccount = Optional
+                .ofNullable(optionalLinkedGLAccountForSavingsProduct(savingsProductId,
+                        AccrualAccountsForSavings.INTEREST_PAYABLE.getValue(), paymentTypeId))
+                .or(() -> Optional.ofNullable(namedSavingsGlAccount(savingsProductId, SAVINGS_INTEREST_PAYABLE_MAPPING)))
+                .orElse(controlAccount);
+        final GLAccount paidAccount = Optional.ofNullable(namedSavingsGlAccount(savingsProductId, SAVINGS_INTEREST_PAID_MAPPING))
+                .orElse(payableAccount);
+
+        // Stage 1: the expense is recognised against whatever the liability sits in right now -- the
+        // named Payable account if the product has one, or straight against Savings Control if it
+        // doesn't. This was missing entirely: every product, configured or not, posted zero journal
+        // entries for interest until this leg existed, since a product with no Payable/Paid names
+        // configured also collapsed stages 2 and 3 below into a same-account no-op with nothing else
+        // to post in their place.
+        postSavingsLeg(office, currencyCode, interestOnSavingsAccount, payableAccount, savingsId, transactionId, transactionDate, amount,
+                isReversal);
+
+        // The interest expense is not raised again here. It was just raised above, and this posting
+        // only settles that recognised debt onward to where it is actually paid out from -- raising
+        // the expense a second time would put the same interest on the P&L twice.
+        //
+        // Stage 2: the liability moves from the payable to the account it is paid out of. Where the
+        // product names no paid account both resolve to the payable and this says nothing, so it is
+        // skipped and the payout comes straight out of the payable.
+        final boolean payableIsPaid = payableAccount.getId().equals(paidAccount.getId());
+        if (!payableIsPaid) {
+            postSavingsLeg(office, currencyCode, payableAccount, paidAccount, savingsId, transactionId, transactionDate, amount,
+                    isReversal);
+        }
+
+        // Stage 3: into the member's own balance.
+        final GLAccount payoutFromAccount = payableIsPaid ? payableAccount : paidAccount;
+        postSavingsLeg(office, currencyCode, payoutFromAccount, controlAccount, savingsId, transactionId, transactionDate, amount,
+                isReversal);
+    }
+
+    /**
+     * One Dr/Cr pair, with both sides swapped when the transaction is a reversal.
+     *
+     * <p>
+     * A leg whose two sides are the same account writes nothing. That is not a defensive check but
+     * the mechanism by which the three stages above collapse: a product that names no payable and no
+     * paid account resolves all three to its Savings Control, and what should remain is the plain
+     * {@code Dr Interest On Savings / Cr Savings Control} pair Fineract has always posted. Skipping
+     * the middle stage by hand was not enough — stage 3 still resolved to Control against Control and
+     * wrote a pair of entries against one account, which nets to nothing yet leaves the transaction's
+     * debits and credits unequal per account and shows up on the trial balance as movement that never
+     * happened. Deciding it here rather than at each call site means every collapse works the same
+     * way, whichever of the two names a product happens to leave unset.
+     */
+    private void postSavingsLeg(final Office office, final String currencyCode, final GLAccount debitAccount,
+            final GLAccount creditAccount, final Long savingsId, final String transactionId, final LocalDate transactionDate,
+            final BigDecimal amount, final boolean isReversal) {
+        if (debitAccount == null || creditAccount == null || debitAccount.getId().equals(creditAccount.getId())) {
+            return;
+        }
+        final GLAccount toDebit = isReversal ? creditAccount : debitAccount;
+        final GLAccount toCredit = isReversal ? debitAccount : creditAccount;
+        createDebitJournalEntryForSavings(office, currencyCode, toDebit, savingsId, transactionId, transactionDate, amount);
+        createCreditJournalEntryForSavings(office, currencyCode, toCredit, savingsId, transactionId, transactionDate, amount);
+    }
+
+    /**
+     * A GL account the savings product maps under one of the reserved names on its Accounting tab.
+     *
+     * <p>
+     * These live in {@code m_savings_product.other_gl_mappings} as a JSON document of
+     * {@code {assets|liabilities|expenses|income: [{accountName, glCode}]}} rather than in
+     * {@code acc_product_mapping}, because they are named extensions rather than one of Fineract's
+     * fixed financial account types. The name is matched across all four groups: which group a bank
+     * files it under is a presentation choice, and an account configured under the wrong heading
+     * should still be honoured rather than silently ignored.
+     *
+     * @return the account, or null where the product does not configure this name
+     */
+    private GLAccount namedSavingsGlAccount(final Long savingsProductId, final String accountName) {
+        if (savingsProductId == null) {
+            return null;
+        }
+        // The column holds an empty string on a product saved with no named mappings, and casting
+        // that to jsonb is an error rather than an empty document - so the cast is done inside a
+        // subquery that has already filtered those rows out. Postgres is free to evaluate a WHERE
+        // clause in any order, so guarding at the same query level as the cast would only work by
+        // luck.
+        final List<Long> found = jdbcTemplate.queryForList("""
+                SELECT gl.id
+                  FROM (SELECT other_gl_mappings::jsonb AS doc
+                          FROM m_savings_product
+                         WHERE id = ?
+                           AND other_gl_mappings IS NOT NULL
+                           AND other_gl_mappings <> ''
+                           AND other_gl_mappings LIKE '{%') sp
+                  CROSS JOIN LATERAL jsonb_array_elements(
+                         COALESCE(sp.doc -> 'assets',      '[]'::jsonb)
+                      || COALESCE(sp.doc -> 'liabilities', '[]'::jsonb)
+                      || COALESCE(sp.doc -> 'expenses',    '[]'::jsonb)
+                      || COALESCE(sp.doc -> 'income',      '[]'::jsonb)
+                  ) AS m(entry)
+                  JOIN acc_gl_account gl ON gl.gl_code = m.entry ->> 'glCode'
+                 WHERE m.entry ->> 'accountName' = ?
+                 LIMIT 1
+                """, Long.class, savingsProductId, accountName);
+        return found.isEmpty() ? null : glAccountRepository.findById(found.get(0)).orElse(null);
+    }
+
     /**
      * Creates a direct transfer journal entry between two savings-type accounts (savings or current),
      * each with their own product GL mapping and entity ID so the correct account number appears per entry.
@@ -621,6 +784,45 @@ public class AccountingProcessorHelper {
         createCreditJournalEntryForSavings(office, currencyCode, creditAccount, creditEntityId, transactionId, transactionDate, amount);
     }
 
+    /**
+     * The same direct transfer where either side may be a current account. A current product maps its GLs under
+     * {@link PortfolioProductType#CURRENT}, so each side's control GL is read under its own product type -- reading a
+     * current product under SAVING picked up the GLs of the savings product that happens to share its id.
+     */
+    public void createDirectTransferJournalEntries(final Office office, final String currencyCode, final Long debitProductId,
+            final boolean debitIsCurrent, final Long debitEntityId, final Long creditProductId, final boolean creditIsCurrent,
+            final Long creditEntityId, final String transactionId, final LocalDate transactionDate, final BigDecimal amount) {
+        final GLAccount debitAccount = controlGlAccount(debitProductId, debitIsCurrent);
+        final GLAccount creditAccount = controlGlAccount(creditProductId, creditIsCurrent);
+        createDebitJournalEntryForSavings(office, currencyCode, debitAccount, debitEntityId, transactionId, transactionDate, amount);
+        createCreditJournalEntryForSavings(office, currencyCode, creditAccount, creditEntityId, transactionId, transactionDate, amount);
+    }
+
+    /** Dr a current product's Current Control, Cr the GL mapped to {@code financialActivity}. */
+    public void createCurrentControlToFinancialActivityJournalEntries(final Office office, final String currencyCode,
+            final Long currentProductId, final int financialActivity, final Long currentAccountId, final String transactionId,
+            final LocalDate transactionDate, final BigDecimal amount) {
+        final GLAccount controlAccount = controlGlAccount(currentProductId, true);
+        final GLAccount activityAccount = this.financialActivityAccountRepository
+                .findByFinancialActivityTypeWithNotFoundDetection(financialActivity).getGlAccount();
+        createDebitJournalEntryForSavings(office, currencyCode, controlAccount, currentAccountId, transactionId, transactionDate, amount);
+        createCreditJournalEntryForSavings(office, currencyCode, activityAccount, currentAccountId, transactionId, transactionDate, amount);
+    }
+
+    private GLAccount controlGlAccount(final Long productId, final boolean isCurrent) {
+        if (!isCurrent) {
+            return getLinkedGLAccountForSavingsProduct(productId, CashAccountsForSavings.SAVINGS_CONTROL.getValue(), null);
+        }
+        final ProductToGLAccountMapping mapping = this.accountMappingRepository.findCoreProductToFinAccountMapping(productId,
+                PortfolioProductType.CURRENT.getValue(), CashAccountsForSavings.SAVINGS_CONTROL.getValue());
+        if (mapping == null) {
+            throw new GeneralPlatformDomainRuleException("error.msg.current.product.control.gl.not.mapped",
+                    "Current product " + productId + " has no Current Control GL mapped; map it on the product's Accounting tab.",
+                    productId);
+        }
+        return mapping.getGlAccount();
+    }
+
     /**
      * Convenience method that creates a pair of related Debits and Credits for Cash Based accounting.
      *
@@ -1241,6 +1443,29 @@ public class AccountingProcessorHelper {
         return accountMapping.getGlAccount();
     }
 
+    /**
+     * One row of the savings product's Accounting tab, or null where the bank has not filled it in.
+     *
+     * <p>
+     * Separate from {@link #getLinkedGLAccountForSavingsProduct}, which throws: not every row is
+     * required. Interest Payable is offered on the product screen but a product configured before it
+     * existed has none, and that has to fall through to the next choice rather than stopping the
+     * account from being closed.
+     */
+    private GLAccount optionalLinkedGLAccountForSavingsProduct(final Long savingsProductId, final int accountMappingTypeId,
+            final Long paymentTypeId) {
+        if (savingsProductId == null) {
+            return null;
+        }
+        // Read directly rather than by catching what getLinkedGLAccountForSavingsProduct throws: on a
+        // missing mapping that method builds its message through CashAccountsForSavings.fromInt,
+        // which returns null for a row the cash enum does not carry - Interest Payable among them -
+        // and the lookup would die on a NullPointerException instead of the exception meant for it.
+        final ProductToGLAccountMapping mapping = this.accountMappingRepository.findCoreProductToFinAccountMapping(savingsProductId,
+                PortfolioProductType.SAVING.getValue(), accountMappingTypeId);
+        return mapping == null ? null : mapping.getGlAccount();
+    }
+
     private GLAccount getLinkedGLAccountForSavingsProduct(final Long savingsProductId, final int accountMappingTypeId,
             final Long paymentTypeId) {
         GLAccount glAccount;
@@ -1292,6 +1517,13 @@ public class AccountingProcessorHelper {
                     accountMapping = paymentChannelSpecificAccountMapping;
                 }
             }
+            // Matches getLinkedGLAccountForSavingsProduct's own guard just above: a share product can
+            // now genuinely have no SHARES_REFERENCE mapping (it stopped being a mandatory field), so
+            // this has to fail with a clean, named error instead of NPEing on accountMapping.
+            if (accountMapping == null) {
+                throw new ProductToGLAccountMappingNotFoundException(PortfolioProductType.SHARES, shareProductId,
+                        CashAccountsForShares.fromInt(accountMappingTypeId).toString());
+            }
             glAccount = accountMapping.getGlAccount();
         }
         return glAccount;

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/CashBasedAccountingProcessorForSavings.java

@@ -170,9 +170,12 @@ public class CashBasedAccountingProcessorForSavings implements AccountingProcess
                 // Post journal entry if earned interest amount is greater than
                 // zero
                 if (savingsTransactionDTO.getAmount().compareTo(BigDecimal.ZERO) > 0) {
-                    this.helper.createCashBasedJournalEntriesAndReversalsForSavings(office, currencyCode,
+                    // Routed through the payable and paid accounts the product names, so the society
-                            CashAccountsForSavings.INTEREST_ON_SAVINGS.getValue(), CashAccountsForSavings.SAVINGS_CONTROL.getValue(),
+                    // can read interest declared but not yet credited as its own balance. Collapses
-                            savingsProductId, paymentTypeId, savingsId, transactionId, transactionDate, amount, isReversal);
+                    // to the plain Dr Interest On Savings / Cr Savings Control pair for a product
+                    // that names neither.
+                    this.helper.createInterestPostingJournalEntriesForSavings(office, currencyCode, savingsProductId, paymentTypeId,
+                            savingsId, transactionId, transactionDate, amount, isReversal);
                 }
             }
 

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/JournalEntryReadPlatformServiceImpl.java

@@ -105,7 +105,23 @@ public class JournalEntryReadPlatformServiceImpl implements JournalEntryReadPlat
                     .append(" journalEntry.currency_code as currencyCode, curr.name as currencyName, curr.internationalized_name_code as currencyNameCode, ")
                     .append(" curr.display_symbol as currencyDisplaySymbol, curr.decimal_places as currencyDigits, curr.currency_multiplesof as inMultiplesOf, ")
                     .append(" eao.external_id as externalAssetOwner, ")
+                    // entity_type_enum=6 (PortfolioProductType.CURRENT) unambiguously names a row in
+                    // m_current_account -- newer write paths tag current-account entries with it
+                    // instead of reusing SAVING's type, specifically so this case needs no guessing.
+                    //
+                    // entity_type_enum=2 (PortfolioProductType.SAVING) is still written for BOTH savings
+                    // and current-account entries by older write paths not yet updated to the above --
+                    // current products used to deliberately share SAVING's GL type space (see
+                    // PortfolioProductType.CURRENT's own comment) -- and m_savings_account/
+                    // m_current_account each have their own id sequence, so an entity_id can be a real
+                    // row in both, making a plain COALESCE(ca.account_no, sa.account_no) pick the current
+                    // account's number even for an entry that is genuinely a savings one.
+                    // savings_transaction_id is the one unambiguous signal available for those older
+                    // entries -- only a real savings transaction sets it -- so it decides first; only
+                    // when it's absent does the current-account guess apply.
                     .append(" CASE ")
+                    .append("   WHEN journalEntry.entity_type_enum = 6 THEN ca.account_no ")
+                    .append("   WHEN journalEntry.entity_type_enum = 2 AND journalEntry.savings_transaction_id IS NOT NULL THEN sa.account_no ")
                     .append("   WHEN journalEntry.entity_type_enum = 2 THEN COALESCE(ca.account_no, sa.account_no) ")
                     .append("   ELSE NULL ")
                     .append(" END as savingsAccountNo ");
@@ -130,7 +146,7 @@ public class JournalEntryReadPlatformServiceImpl implements JournalEntryReadPlat
                     .append(" left join m_external_asset_owner_journal_entry_mapping eajem on eajem.journal_entry_id = journalEntry.id ")
                     .append(" left join m_external_asset_owner eao on eao.id = eajem.owner_id ")
                     .append(" left join m_savings_account sa on sa.id = journalEntry.entity_id AND journalEntry.entity_type_enum = 2 ")
-                    .append(" left join m_current_account ca on ca.id = journalEntry.entity_id AND journalEntry.entity_type_enum = 2 ");
+                    .append(" left join m_current_account ca on ca.id = journalEntry.entity_id AND journalEntry.entity_type_enum IN (2, 6) ");
             if (associationParametersData.isTransactionDetailsRequired()) {
                 sb.append(" left join m_loan_transaction as lt on journalEntry.loan_transaction_id = lt.id ")
                         .append(" left join m_savings_account_transaction as st on journalEntry.savings_transaction_id = st.id ")

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/JournalEntryWritePlatformServiceJpaRepositoryImpl.java

@@ -21,6 +21,7 @@ package org.apache.fineract.accounting.journalentry.service;
 import java.math.BigDecimal;
 import java.time.LocalDate;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -391,6 +392,9 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
         } else if (!creditOrDebitAccountHead.isManualEntriesAllowed()) {
             throw new JournalEntryInvalidException(GlJournalEntryInvalidReason.GL_ACCOUNT_MANUAL_ENTRIES_NOT_PERMITTED, null,
                     creditOrDebitAccountHead.getName(), creditOrDebitAccountHead.getGlCode());
+        } else if (creditOrDebitAccountHead.isHeaderAccount()) {
+            throw new JournalEntryInvalidException(GlJournalEntryInvalidReason.GL_ACCOUNT_IS_HEADER, null,
+                    creditOrDebitAccountHead.getName(), creditOrDebitAccountHead.getGlCode());
         }
     }
 
@@ -627,7 +631,12 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
         final boolean cashBasedAccountingEnabled = (Boolean) accountingBridgeData.get("cashBasedAccountingEnabled");
         final boolean accrualBasedAccountingEnabled = (Boolean) accountingBridgeData.get("accrualBasedAccountingEnabled");
 
-        if (cashBasedAccountingEnabled) {
+        // A register that knows the transaction's real counterparty posts the entry itself, in one
+        // balanced pair against that account, and says so by wrapping the command in
+        // ShareAccountingSuppression.withOwnShareEntries(). Posting here as well would add a second
+        // entry for the same money, booked against the product's fixed Shares Reference account --
+        // which is what that register is avoiding in the first place.
+        if (cashBasedAccountingEnabled && ShareAccountingSuppression.shouldPostShareEntries()) {
             final SharesDTO sharesDTO = this.helper.populateSharesDtoFromMap(accountingBridgeData, cashBasedAccountingEnabled,
                     accrualBasedAccountingEnabled);
             final AccountingProcessorForShares accountingProcessorForShares = this.accountingProcessorForSharesFactory
@@ -775,15 +784,30 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
             final String currencyCode = command.stringValueOfParameterNamed(JournalEntryJsonInputParams.CURRENCY_CODE.getValue());
 
             validateBusinessRulesForJournalEntries(journalEntryCommand);
+            validateNoDenominationManagedCashAccounts(journalEntryCommand);
 
             /**
              * revert old journal entries
+             *
+             * A transaction that carries a leg against the denomination-managed cash account (see
+             * validateNoDenominationManagedCashAccounts) is skipped here rather than reversed: it is
+             * tied to this same office+contra pairing (Migrate Cash Denomination posts its opening
+             * entry against this same Opening Balances Contra account), so the query above finds it
+             * too. Reversing it here, while the new submission is barred from ever re-posting a cash
+             * leg, would silently erase the cash account's opening balance every time an admin
+             * redefines opening balances for any OTHER account at this office.
              */
+            final List<Long> denominationManagedGlAccountIds = resolveDenominationManagedCashGlAccountIds();
             final List<String> transactionIdsToBeReversed = this.glJournalEntryRepository.findNonReversedContraTransactionIds(contraId,
                     officeId);
             for (String transactionId : transactionIdsToBeReversed) {
                 final List<JournalEntry> journalEntries = this.glJournalEntryRepository
                         .findUnReversedManualJournalEntriesByTransactionId(transactionId);
+                final boolean touchesDenominationManagedCashAccount = journalEntries.stream()
+                        .anyMatch(je -> je.getGlAccount() != null && denominationManagedGlAccountIds.contains(je.getGlAccount().getId()));
+                if (touchesDenominationManagedCashAccount) {
+                    continue;
+                }
                 revertJournalEntry(journalEntries, "defining opening balance");
             }
 
@@ -865,6 +889,55 @@ public class JournalEntryWritePlatformServiceJpaRepositoryImpl implements Journa
         }
     }
 
+    /**
+     * The GL account(s) Financial Activity 101 (Cash at Vault) / 102 (Cash at Teller) map to. Shared
+     * by the validation below and by defineOpeningBalance's own revert step, so both agree on exactly
+     * which account(s) Migrate Cash Denomination owns.
+     */
+    private List<Long> resolveDenominationManagedCashGlAccountIds() {
+        final List<Long> ids = new ArrayList<>();
+        for (final FinancialActivityAccount mapping : this.financialActivityAccountRepositoryWrapper.findAll()) {
+            final Integer type = mapping.getFinancialActivityType();
+            if ((type != null && (type == 101 || type == 102)) && mapping.getGlAccount() != null) {
+                ids.add(mapping.getGlAccount().getId());
+            }
+        }
+        return ids;
+    }
+
+    /**
+     * The GL account(s) mapped to Financial Activity 101 (Cash at Vault) / 102 (Cash at Teller) are
+     * managed exclusively through Migrate Cash Denomination (BranchDayRegisterApiResource#migrateCashDenomination),
+     * which keeps the GL figure tied to an actual counted note-and-coin breakdown, and validates any
+     * redefinition against that same count. Defining or redefining that account's opening balance here
+     * instead - as a bare number, with no denomination breakdown behind it - would let the GL figure
+     * drift away from what is physically in the till, with nothing left to catch the mismatch. So this
+     * command refuses to touch either of those accounts at all, on either side of the entry, rather than
+     * only when the amount would differ from what is already posted: the physical count is the only
+     * source of truth for this account, never a number typed into a generic opening-balance grid.
+     */
+    private void validateNoDenominationManagedCashAccounts(final JournalEntryCommand command) {
+        final List<Long> denominationManagedGlAccountIds = resolveDenominationManagedCashGlAccountIds();
+        if (denominationManagedGlAccountIds.isEmpty()) {
+            return;
+        }
+        final List<SingleDebitOrCreditEntryCommand> allEntries = new ArrayList<>();
+        if (command.getDebits() != null) {
+            allEntries.addAll(Arrays.asList(command.getDebits()));
+        }
+        if (command.getCredits() != null) {
+            allEntries.addAll(Arrays.asList(command.getCredits()));
+        }
+        for (final SingleDebitOrCreditEntryCommand entry : allEntries) {
+            if (denominationManagedGlAccountIds.contains(entry.getGlAccountId())) {
+                throw new GeneralPlatformDomainRuleException("error.msg.journalentry.opening.balance.cash.account.locked",
+                        "This account is the tenant's Cash at Vault / Cash at Teller account and is managed through "
+                                + "Migrate Cash Denomination - it cannot be set or changed from Migrate Opening Balances.",
+                        entry.getGlAccountId());
+            }
+        }
+    }
+
     @Override
     public void createJournalEntriesForClientTransactions(Map<String, Object> accountingBridgeData) {
         final ClientTransactionDTO clientTransactionDTO = this.helper.populateClientTransactionDtoFromMap(accountingBridgeData);

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/LedgerTransactionId.java

@@ -0,0 +1,157 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.journalentry.service;
+
+import java.sql.Date;
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+/**
+ * Mints the transaction id that ties the rows of one posting together in acc_gl_journal_entry.
+ *
+ * <p>
+ * Every feature here that posts a journal entry by direct JDBC used to invent this id by hand, and the two
+ * shapes that emerged were each wrong in their own way. Some concatenated a business row's own primary key
+ * ({@code "DIVROUND" + dividendPayOutId}); a primary key is only unique while its sequence keeps climbing,
+ * so a reset hands the same number out twice - which is exactly how two unrelated share withdrawals came to
+ * share one transaction id and render as a single doubled voucher. Others concatenated
+ * {@code System.nanoTime()}, which is unique but says nothing to whoever reads it off a screen
+ * ({@code "CASHMIG-1-20260913-923935527932300"}).
+ *
+ * <p>
+ * This generator replaces both with one readable shape, {@code PREFIX-YYMMDD-NNNN}:
+ *
+ * <pre>
+ *   SHWGL-260916-0001   the first share-withdrawal GL settlement posted on 16 Sep 2026
+ *   DIVRND-260916-0007  the seventh dividend rounding posted that day
+ * </pre>
+ *
+ * The prefix names the event, the date is the tenant's business date, and the serial restarts at 0001 each
+ * day. That makes a transaction id self-describing: a reader can tell what it was and when it happened
+ * without looking anything up.
+ *
+ * <p>
+ * Uniqueness does not depend on any business table. The serial comes from {@code m_ledger_txn_sequence}, a
+ * counter that belongs to no entity, so no entity's sequence can make it repeat. The counter is bumped by a
+ * single {@code INSERT ... ON CONFLICT DO UPDATE}, which takes and releases the row lock atomically, so two
+ * users posting at the same instant are serialised by the database rather than handed the same number - the
+ * same mechanism {@code m_voucher_sequence} already uses for voucher numbers.
+ *
+ * <p>
+ * The counter alone would still repeat if that table were ever truncated or rewound by hand, which is
+ * precisely the accident being defended against, so the minted id is also checked against the ledger before
+ * being handed back and the counter is advanced past anything already in use. That makes a duplicate
+ * impossible by construction rather than by convention: the id is only returned once no row holds it.
+ *
+ * <p>
+ * Ids already in the ledger keep their old shape. Nothing reconstructs a custom id to find its rows again
+ * (every call site mints one, posts with it, and never derives it a second time), so old and new shapes
+ * coexist without anything needing to read both.
+ *
+ * <p>
+ * Postings made by Fineract's own command path are not covered here and keep their native
+ * {@code "S"/"L"/"SH"/"C" + transaction id} form, which {@code AccountingProcessorHelper} derives and
+ * several readers reconstruct. Those readers are hardened at the query instead, by resolving to the most
+ * recently posted rows rather than assuming the text is unique.
+ */
+public final class LedgerTransactionId {
+
+    /** Guards against an impossible-in-practice runaway if the ledger and the counter disagree. */
+    private static final int MAX_PROBES = 50;
+
+    private static final DateTimeFormatter YYMMDD = DateTimeFormatter.ofPattern("yyMMdd");
+
+    private LedgerTransactionId() {}
+
+    /**
+     * Returns the next transaction id for this kind of posting, e.g. {@code SHWGL-260916-0001}.
+     *
+     * @param prefix
+     *            short uppercase code naming the event, from {@link LedgerTxnPrefix}
+     */
+    public static String next(final JdbcTemplate jdbcTemplate, final String prefix) {
+        // Tenant timezone, not the server's - the day the counter resets on has to be the branch's
+        // business day, otherwise a late-evening posting lands in the wrong series.
+        final LocalDate today = LocalDate.now(DateUtils.getDateTimeZoneOfTenant());
+        final String datePart = today.format(YYMMDD);
+
+        for (int probe = 0; probe < MAX_PROBES; probe++) {
+            final int serial = nextSerial(jdbcTemplate, prefix, today);
+            final String candidate = String.format("%s-%s-%04d", prefix, datePart, serial);
+            if (!isTaken(jdbcTemplate, candidate)) {
+                return candidate;
+            }
+            // Only reachable if the counter was rewound behind the ledger by hand. Bumping again walks
+            // it forward until it clears whatever is already posted, which self-heals the counter.
+        }
+        throw new IllegalStateException("Could not mint a free ledger transaction id for prefix " + prefix + " after " + MAX_PROBES
+                + " attempts. The m_ledger_txn_sequence counter for this prefix is far behind the entries already posted today.");
+    }
+
+    /**
+     * Returns the id for a posting that has to be reproducible, e.g. {@code SAVINT-260916-P0002}.
+     *
+     * <p>
+     * Some postings are not one-shot: a pooled interest run pays hundreds of members, and a run that
+     * stops halfway is resumed rather than restarted. Those resumed legs belong to the posting that
+     * started them, so the id has to come out the same on the second pass - a counter would hand the
+     * remainder a different id and split one posting across two transactions. This builds the id from
+     * what identifies the run instead: the same prefix, date and discriminator always produce the same
+     * string, and no counter is consumed.
+     *
+     * <p>
+     * Uniqueness rests on the caller's own discriminator being unique for that prefix and date (the
+     * product being posted, say), which is what makes the id reproducible in the first place. Use
+     * {@link #next} for everything else - a posting that happens once wants a counter, not a formula.
+     * The {@code P} marks the tail as a discriminator so it is not misread as a serial.
+     *
+     * @param date
+     *            the date the posting belongs to, which is not always today - interest can be posted
+     *            for an earlier day
+     * @param discriminator
+     *            what makes this run distinct from another on the same date, e.g. the product id
+     */
+    public static String forDatedSeries(final String prefix, final LocalDate date, final long discriminator) {
+        return String.format("%s-%s-P%04d", prefix, date.format(YYMMDD), discriminator);
+    }
+
+    /**
+     * Reserves the next counter value for one (prefix, day) series.
+     *
+     * The INSERT ... ON CONFLICT DO UPDATE both creates the series on its first use of the day and
+     * increments it thereafter. Being a single statement it is atomic, so no explicit lock is needed.
+     */
+    private static int nextSerial(final JdbcTemplate jdbcTemplate, final String prefix, final LocalDate day) {
+        return jdbcTemplate.queryForObject("""
+                INSERT INTO m_ledger_txn_sequence (prefix, series_date, last_number)
+                VALUES (?,?,1)
+                ON CONFLICT (prefix, series_date)
+                DO UPDATE SET last_number = m_ledger_txn_sequence.last_number + 1
+                RETURNING last_number
+                """, Integer.class, prefix, Date.valueOf(day));
+    }
+
+    private static boolean isTaken(final JdbcTemplate jdbcTemplate, final String transactionId) {
+        final Boolean taken = jdbcTemplate.queryForObject("SELECT EXISTS (SELECT 1 FROM acc_gl_journal_entry WHERE transaction_id = ?)",
+                Boolean.class, transactionId);
+        return Boolean.TRUE.equals(taken);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/LedgerTxnPrefix.java

@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.journalentry.service;
+
+/**
+ * The event codes that open a transaction id minted by {@link LedgerTransactionId}.
+ *
+ * <p>
+ * They live together in one place so a reader can decode any transaction id on a screen from a single list,
+ * and so no two features can drift into naming the same event differently - which had already happened:
+ * dividend forfeiture was posting under {@code DIVFORF} from one service and {@code DIVFORFEIT} from
+ * another, for the same event.
+ *
+ * <p>
+ * Codes are uppercase, up to eight characters, and grouped by the module that raises them. A code is part of
+ * the audit trail once it has been posted, so treat these as append-only: add a new one for a new event
+ * rather than renaming an existing one, which would leave already-posted entries speaking a language nothing
+ * else uses any more.
+ */
+public final class LedgerTxnPrefix {
+
+    private LedgerTxnPrefix() {}
+
+    // A clerk's share withdrawal has no code here on purpose: it posts under the transaction id the
+    // native redeem command already minted ("SH" + share transaction id), because its debit leg is
+    // that command's own and the two have to group as one balanced entry.
+
+    // ── Share tranche funding ─────────────────────────────────────────────────
+    /** Additional share tranche: reversal of the stock reference posting. */
+    public static final String SHARE_TRANCHE_REFERENCE = "SHTREF";
+    /** Additional share tranche funded from the member's savings account. */
+    public static final String SHARE_TRANCHE_SAVINGS = "SHTSAV";
+
+    // ── Share collection and advances ─────────────────────────────────────────
+    /** Share application money collected. */
+    public static final String SHARE_COLLECTION = "SHCOL";
+    /** Share advance collected against a future allotment. */
+    public static final String SHARE_ADVANCE = "SHADV";
+    /** Share advance applied to an allotment. */
+    public static final String SHARE_ADVANCE_APPLIED = "SHAPP";
+
+    // ── Dividend ──────────────────────────────────────────────────────────────
+    /** Dividend claim paid out to a member. */
+    public static final String DIVIDEND_CLAIM = "DIVCLM";
+    /** Dividend declaration posted. */
+    public static final String DIVIDEND_DECLARED = "DIVDCL";
+    /** Dividend declaration approved. */
+    public static final String DIVIDEND_APPROVED = "DIVAPR";
+    /** Dividend payout closed off. */
+    public static final String DIVIDEND_CLOSED = "DIVCLS";
+    /** Rounding difference on a dividend payout. */
+    public static final String DIVIDEND_ROUNDING = "DIVRND";
+    /** Unclaimed dividend forfeited. */
+    public static final String DIVIDEND_FORFEIT = "DIVFRF";
+
+    // ── Branch day and cash ───────────────────────────────────────────────────
+    /** Opening cash migrated into the branch day register. */
+    public static final String CASH_MIGRATION = "CSHMIG";
+    /** Rounding difference on a clerk's day closure. */
+    public static final String CLOSURE_ROUNDING = "CLSRND";
+
+    // ── Year end ──────────────────────────────────────────────────────────────
+    /** Year-end transfer of income into the profit account. */
+    public static final String YEAR_END_PROFIT = "YEPFT";
+    /** Year-end closure of an income or expense account. */
+    public static final String YEAR_END_CLOSE = "YECLS";
+
+    // ── Savings ───────────────────────────────────────────────────────────────
+    /** Pooled savings interest posting for one product and date. */
+    public static final String SAVINGS_INTEREST_POOLED = "SAVINT";
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/service/ShareAccountingSuppression.java

@@ -0,0 +1,83 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.accounting.journalentry.service;
+
+import java.util.function.Supplier;
+
+/**
+ * Lets a register that posts a share transaction's accounting itself tell the platform not to post its
+ * own.
+ *
+ * <h3>Why this exists</h3>
+ *
+ * <p>
+ * Fineract books every share transaction against a fixed "Shares Reference" account taken from the
+ * product's GL mapping: a redemption posts Dr Shares Equity / Cr Shares Reference, whatever the money
+ * actually did. That account is a placeholder for a counterparty the platform does not know, and in a
+ * real core banking ledger there is no such thing — a redemption paid in cash credits the cash
+ * account, and one settled by transfer credits the account it was transferred to. Naming a single
+ * asset account for both leaves every redemption sitting against a GL the money never touched, which
+ * then has to be corrected by hand.
+ *
+ * <p>
+ * The governed clerk registers already know the real counterparty, because the clerk keyed it: the
+ * linked savings account, or the GL picked on the transfer's credit row. They post the redemption
+ * themselves, correctly, in one balanced entry. Before this flag existed they had to let the platform
+ * post its version first and then reverse the half that was wrong, which left a dead Cr Shares
+ * Reference row behind on every redemption and made the ledger read as though cash had moved.
+ *
+ * <h3>Why a flag and not the product's accounting rule</h3>
+ *
+ * <p>
+ * Turning the share product's accounting off entirely ({@code m_share_product.accounting_type = NONE})
+ * would silence the platform everywhere, including the share account screen's own Redeem action, which
+ * no register covers — those redemptions would post nothing at all and go unnoticed, because that
+ * branch fails silently by design. Scoping the suppression to the one call that is about to post its
+ * own entry leaves every other path exactly as it is.
+ *
+ * <p>
+ * A ThreadLocal rather than a request attribute, and restoring the previous value rather than clearing
+ * it, for the same reasons as {@code VoucherService.withOwnVoucher} — a batch job has no request to
+ * hang the flag on, and nesting must not switch the suppression off early for an outer caller.
+ */
+public final class ShareAccountingSuppression {
+
+    private static final ThreadLocal<Boolean> CALLER_POSTS_SHARE_ENTRIES = ThreadLocal.withInitial(() -> Boolean.FALSE);
+
+    private ShareAccountingSuppression() {}
+
+    /**
+     * Runs {@code command} with the platform's own share journal entries suppressed, for a caller that
+     * posts the transaction's accounting itself.
+     */
+    public static <T> T withOwnShareEntries(final Supplier<T> command) {
+        final boolean previous = CALLER_POSTS_SHARE_ENTRIES.get();
+        CALLER_POSTS_SHARE_ENTRIES.set(Boolean.TRUE);
+        try {
+            return command.get();
+        } finally {
+            CALLER_POSTS_SHARE_ENTRIES.set(previous);
+        }
+    }
+
+    /** False only while a caller inside {@link #withOwnShareEntries} is posting its own entries. */
+    public static boolean shouldPostShareEntries() {
+        return !CALLER_POSTS_SHARE_ENTRIES.get();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/accounting/journalentry/starter/AccountingJournalEntryConfiguration.java

@@ -68,10 +68,10 @@ public class AccountingJournalEntryConfiguration {
             FinancialActivityAccountRepositoryWrapper financialActivityAccountRepository, GLClosureRepository closureRepository,
             GLAccountRepository glAccountRepository, OfficeRepository officeRepository,
             AccountTransfersReadPlatformService accountTransfersReadPlatformService, ChargeRepositoryWrapper chargeRepositoryWrapper,
-            BusinessEventNotifierService businessEventNotifierService) {
+            BusinessEventNotifierService businessEventNotifierService, JdbcTemplate jdbcTemplate) {
         return new AccountingProcessorHelper(glJournalEntryRepository, accountMappingRepository, financialActivityAccountRepository,
                 closureRepository, glAccountRepository, officeRepository, accountTransfersReadPlatformService, chargeRepositoryWrapper,
-                businessEventNotifierService);
+                businessEventNotifierService, jdbcTemplate);
     }
 
     @Bean

fineract-provider/src/main/java/org/apache/fineract/accounting/productaccountmapping/service/ProductToGLAccountMappingWritePlatformServiceImpl.java

@@ -301,6 +301,15 @@ public class ProductToGLAccountMappingWritePlatformServiceImpl implements Produc
                     CashAccountsForSavings.ESCHEAT_LIABILITY.getValue());
         }
 
+        // Optional: only mapped when the product screen supplies it. Every savings product that
+        // existed before this row was added has none, and a closure on one of those still has to
+        // work — see the closure's own fallback.
+        if (this.fromApiJsonHelper.parameterExists(SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(), element)) {
+            this.savingsProductToGLAccountMappingHelper.saveSavingsToExpenseAccountMapping(element,
+                    SavingProductAccountingParams.ROUNDING_ADJUSTMENT.getValue(), savingProductId,
+                    CashAccountsForSavings.ROUNDING_ADJUSTMENT.getValue());
+        }
+
         // advanced accounting mappings
         this.savingsProductToGLAccountMappingHelper.savePaymentChannelToFundSourceMappings(command, element, savingProductId, null);
         this.savingsProductToGLAccountMappingHelper.saveChargesToIncomeAccountMappings(command, element, savingProductId, null);
@@ -320,6 +329,18 @@ public class ProductToGLAccountMappingWritePlatformServiceImpl implements Produc
             break;
             case CASH_BASED:
                 saveSavingsBaseAccountMapping(savingProductId, accountType, command, element);
+                // Interest Payable is saved on cash too, and optionally: interest posting routes
+                // through it on either basis (see AccountingProcessorHelper
+                // .createInterestPostingJournalEntriesForSavings), so that interest declared but not
+                // yet credited to the member reads as the bank's own liability rather than appearing
+                // only at the moment it is paid. Mapped only when the screen supplies it - a product
+                // naming none still posts straight to Savings Control, as it always did.
+                if (this.fromApiJsonHelper.parameterExists(SavingProductAccountingParams.INTEREST_PAYABLE.getValue(),
+                        element)) {
+                    this.savingsProductToGLAccountMappingHelper.saveSavingsToLiabilityAccountMapping(element,
+                            SavingProductAccountingParams.INTEREST_PAYABLE.getValue(), savingProductId,
+                            AccrualAccountsForSavings.INTEREST_PAYABLE.getValue());
+                }
             break;
 
             case ACCRUAL_PERIODIC:

fineract-provider/src/main/java/org/apache/fineract/accounting/profitandloss/api/DistributableProfitApiResource.java

@@ -37,6 +37,7 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import lombok.RequiredArgsConstructor;
+import org.apache.fineract.accounting.common.DividendGlAccountResolver;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.stereotype.Component;
 
@@ -60,13 +61,12 @@ import org.springframework.stereotype.Component;
 public class DistributableProfitApiResource {
 
     /**
-     * The year's closed-out profit, which is what a dividend may be declared against; kept in step with
+     * The year's closed-out profit, which is what a dividend may be declared against.
-     * IncomeProfitTransferService.PROFIT_GL_CODE.
      *
-     * Deliberately not plain Bank Profit — that holds what earlier declarations left behind, and reading it here would
+     * Deliberately not Retained Profit — that holds what earlier declarations left behind, and reading it here would
      * offer profit already distributed once for distribution again.
      */
-    private static final String PROFIT_GL_CODE = "BANKPROFITND01";
+    private final DividendGlAccountResolver dividendGlAccounts;
 
     private static final String CONFIG_MAXIMUM_RATE = "dividend-maximum-rate-percentage";
 
@@ -162,9 +162,9 @@ public class DistributableProfitApiResource {
         final BigDecimal balance = jdbcTemplate.queryForObject("""
                 SELECT COALESCE(SUM(CASE WHEN je.type_enum = 1 THEN je.amount ELSE -je.amount END), 0)
                 FROM acc_gl_journal_entry je
-                JOIN acc_gl_account a ON a.id = je.account_id
+                WHERE je.account_id = ? AND je.reversed = false AND je.entry_date BETWEEN ? AND ?
-                WHERE a.gl_code = ? AND je.reversed = false AND je.entry_date BETWEEN ? AND ?
+                """, BigDecimal.class, dividendGlAccounts.distributableProfitAccount(), java.sql.Date.valueOf(range[0]),
-                """, BigDecimal.class, PROFIT_GL_CODE, java.sql.Date.valueOf(range[0]), java.sql.Date.valueOf(range[1]));
+                java.sql.Date.valueOf(range[1]));
         return balance == null ? BigDecimal.ZERO : balance;
     }
 

fineract-provider/src/main/java/org/apache/fineract/accounting/yearend/api/IncomeProfitTransferApiResource.java

@@ -58,7 +58,7 @@ public class IncomeProfitTransferApiResource {
                 ? IncomeProfitTransferService.DEFAULT_INCOME_GL_CODE
                 : incomeGlCodeParam.trim();
         final Map<String, Object> incomeGl = service.loadGlByCode(incomeGlCode);
-        final Map<String, Object> profitGl = service.loadGlByCode(IncomeProfitTransferService.PROFIT_GL_CODE);
+        final Map<String, Object> profitGl = service.loadDistributableProfitGl();
 
         final String financialYear = financialYearParam == null || financialYearParam.isBlank() ? service.currentFinancialYear()
                 : financialYearParam.trim();

fineract-provider/src/main/java/org/apache/fineract/accounting/yearend/service/IncomeProfitTransferService.java

@@ -10,6 +10,10 @@ import java.util.List;
 import java.util.Map;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.accounting.common.DividendGlAccountResolver;
+import org.apache.fineract.accounting.glaccount.validation.GLAccountTransactionGuard;
+import org.apache.fineract.accounting.journalentry.service.LedgerTransactionId;
+import org.apache.fineract.accounting.journalentry.service.LedgerTxnPrefix;
 import org.apache.fineract.infrastructure.core.exception.PlatformDataIntegrityException;
 import org.apache.fineract.infrastructure.core.service.DateUtils;
 import org.springframework.dao.EmptyResultDataAccessException;
@@ -22,7 +26,7 @@ import org.springframework.transaction.annotation.Transactional;
  *
  * <pre>
  *   Dr  Share Entry Fee Income (10.4)   = balance for the year
- *   Cr  Bank Profit (BANKPROFIT01)
+ *   Cr  Distributable Profit            (the GL mapped to that financial activity)
  * </pre>
  *
  * Debiting the income account brings it back to nil so the new year starts clean; the credit accumulates in equity as
@@ -42,22 +46,23 @@ public class IncomeProfitTransferService {
     private static final int DEBIT = 2;
     private static final int CREDIT = 1;
 
-    /** Equity GL that accumulates profit. */
-    /**
-     * The year's profit is closed into the Non-Distributable account, not plain Bank Profit.
-     *
-     * A dividend is declared against this balance; whatever the members do not receive moves across to Bank Profit once
-     * the declaration is approved. Closing into Bank Profit directly would mix the year just ended with earlier years'
-     * leftovers, and the next declaration would be sized on profit that had already been through a distribution
-     * decision — offering the same money for distribution twice.
-     */
-    public static final String PROFIT_GL_CODE = "BANKPROFITND01";
-
     /** Income GL closed to profit by the year-end job — the share entry fee. */
     public static final String DEFAULT_INCOME_GL_CODE = "10.4";
 
     private final JdbcTemplate jdbcTemplate;
 
+    /**
+     * The year's profit is closed into the Distributable Profit account, not the Retained one.
+     *
+     * A dividend is declared against this balance; whatever the members do not receive moves across to Retained Profit
+     * once the declaration is approved. Closing into Retained directly would mix the year just ended with earlier
+     * years' leftovers, and the next declaration would be sized on profit that had already been through a distribution
+     * decision — offering the same money for distribution twice.
+     *
+     * Both accounts are configured on Financial Activity Mappings; this was the hardcoded GL code BANKPROFITND01.
+     */
+    private final DividendGlAccountResolver dividendGlAccounts;
+
     /**
      * Posts the year-end transfer. Returns a summary of what was posted, or a summary with {@code posted = false} when
      * there was nothing to do (already closed, or a nil balance) — those are normal outcomes for a scheduled run, not
@@ -72,7 +77,7 @@ public class IncomeProfitTransferService {
             final String note, final boolean strict) {
 
         final Map<String, Object> incomeGl = loadGlByCode(incomeGlCode);
-        final Map<String, Object> profitGl = loadGlByCode(PROFIT_GL_CODE);
+        final Map<String, Object> profitGl = loadDistributableProfitGl();
         final Long incomeGlId = toLong(incomeGl.get("id"));
         final Long profitGlId = toLong(profitGl.get("id"));
 
@@ -114,7 +119,7 @@ public class IncomeProfitTransferService {
         final String currencyCode = resolveCurrency(incomeGlId);
         final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
         final LocalDate postingDate = range[1];
-        final String txnId = "YEPROFIT-" + System.nanoTime();
+        final String txnId = LedgerTransactionId.next(this.jdbcTemplate, LedgerTxnPrefix.YEAR_END_PROFIT);
         final String desc = "Year-end closing " + financialYear + " — " + incomeGl.get("name") + " to profit"
                 + (note != null ? " | " + note : "");
 
@@ -165,7 +170,7 @@ public class IncomeProfitTransferService {
     public Map<String, Object> closeAllToProfit(final String financialYear, final Long userId, final String userName, final String note,
             final boolean strict) {
 
-        final Map<String, Object> profitGl = loadGlByCode(PROFIT_GL_CODE);
+        final Map<String, Object> profitGl = loadDistributableProfitGl();
         final Long profitGlId = toLong(profitGl.get("id"));
         final LocalDate[] range = financialYearRange(financialYear);
         final Long officeId = headOfficeId();
@@ -207,7 +212,7 @@ public class IncomeProfitTransferService {
             final String currencyCode = resolveCurrency(glId);
             final LocalDateTime now = LocalDateTime.now(DateUtils.getDateTimeZoneOfTenant());
             final LocalDate postingDate = range[1];
-            final String txnId = "YECLOSE-" + financialYear + "-" + gl.get("gl_code") + "-" + System.nanoTime();
+            final String txnId = LedgerTransactionId.next(this.jdbcTemplate, LedgerTxnPrefix.YEAR_END_CLOSE);
             final String descr = "Year-end closing " + financialYear + " — " + gl.get("name") + " to profit"
                     + (note != null ? " | " + note : "");
 
@@ -283,7 +288,7 @@ public class IncomeProfitTransferService {
      */
     public BigDecimal profitForFinancialYear(final String financialYear) {
         final LocalDate[] range = financialYearRange(financialYear);
-        final Map<String, Object> profitGl = loadGlByCode(PROFIT_GL_CODE);
+        final Map<String, Object> profitGl = loadDistributableProfitGl();
         final BigDecimal balance = jdbcTemplate.queryForObject(
                 "SELECT COALESCE(SUM(CASE WHEN type_enum = ? THEN amount ELSE -amount END), 0) "
                         + " FROM acc_gl_journal_entry WHERE account_id = ? AND reversed = false AND entry_date BETWEEN ? AND ?",
@@ -342,6 +347,21 @@ public class IncomeProfitTransferService {
         }
     }
 
+    /** As {@link #loadGlByCode}, for an account already identified by a financial activity mapping. */
+    public Map<String, Object> loadGlById(final Long glAccountId) {
+        try {
+            return jdbcTemplate.queryForMap("SELECT id, gl_code, name, classification_enum FROM acc_gl_account WHERE id = ?", glAccountId);
+        } catch (EmptyResultDataAccessException e) {
+            throw new PlatformDataIntegrityException("error.msg.incomeprofit.gl.not.found",
+                    "GL account " + glAccountId + " does not exist.");
+        }
+    }
+
+    /** The distributable-profit GL the year's income closes into, as configured on Financial Activity Mappings. */
+    public Map<String, Object> loadDistributableProfitGl() {
+        return loadGlById(this.dividendGlAccounts.distributableProfitAccount());
+    }
+
     public Long headOfficeId() {
         return jdbcTemplate.queryForObject("SELECT id FROM m_office ORDER BY hierarchy LIMIT 1", Long.class);
     }
@@ -359,6 +379,7 @@ public class IncomeProfitTransferService {
 
     private void insertEntry(final Long officeId, final Long glAccountId, final int typeEnum, final BigDecimal amount, final String txnId,
             final LocalDate entryDate, final Long userId, final LocalDateTime now, final String currencyCode, final String description) {
+        GLAccountTransactionGuard.assertPostable(jdbcTemplate, glAccountId);
         jdbcTemplate.update(
                 "INSERT INTO acc_gl_journal_entry " + "(account_id, office_id, currency_code, transaction_id, reversed, manual_entry, "
                         + " entry_date, type_enum, amount, description, "

fineract-provider/src/main/java/org/apache/fineract/cob/api/LoanCOBCatchUpApiResource.java

@@ -35,6 +35,7 @@ import org.apache.fineract.cob.data.OldestCOBProcessedLoanDTO;
 import org.apache.fineract.cob.service.LoanCOBCatchUpService;
 import org.apache.fineract.infrastructure.core.exception.JobIsNotFoundOrNotEnabledException;
 import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.springframework.stereotype.Component;
 
 @Path("/v1/loans")
@@ -44,6 +45,7 @@ import org.springframework.stereotype.Component;
 public class LoanCOBCatchUpApiResource {
 
     private final Optional<LoanCOBCatchUpService> loanCOBCatchUpServiceOp;
+    private final PlatformSecurityContext context;
 
     @GET
     @Path("oldest-cob-closed")
@@ -64,6 +66,7 @@ public class LoanCOBCatchUpApiResource {
     @ApiResponse(responseCode = "202", description = "Catch Up has been started")
     @ApiResponse(responseCode = "400", description = "Catch Up is already running")
     public Response executeLoanCOBCatchUp() {
+        this.context.authenticatedUser().validateHasPermissionTo("EXECUTE_LOANCOBCATCHUP");
         return loanCOBCatchUpServiceOp.map(loanCOBCatchUpService -> {
             if (loanCOBCatchUpService.isCatchUpRunning().isCatchUpRunning()) {
                 return Response.status(Response.Status.BAD_REQUEST).build();

fineract-provider/src/main/java/org/apache/fineract/infrastructure/businessdate/jobs/syncbusinessdate/SyncBusinessDateConfig.java

@@ -0,0 +1,52 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.businessdate.jobs.syncbusinessdate;
+
+import org.apache.fineract.infrastructure.jobs.service.JobName;
+import org.springframework.batch.core.Job;
+import org.springframework.batch.core.Step;
+import org.springframework.batch.core.job.builder.JobBuilder;
+import org.springframework.batch.core.launch.support.RunIdIncrementer;
+import org.springframework.batch.core.repository.JobRepository;
+import org.springframework.batch.core.step.builder.StepBuilder;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.transaction.PlatformTransactionManager;
+
+@Configuration
+public class SyncBusinessDateConfig {
+
+    @Autowired
+    private JobRepository jobRepository;
+    @Autowired
+    private PlatformTransactionManager transactionManager;
+
+    @Bean
+    protected Step syncBusinessDateStep(final SyncBusinessDateTasklet syncBusinessDateTasklet) {
+        return new StepBuilder(JobName.SYNC_BUSINESS_DATE_TO_SYSTEM_DATE.name(), jobRepository)
+                .tasklet(syncBusinessDateTasklet, transactionManager).build();
+    }
+
+    @Bean
+    public Job syncBusinessDateJob(final SyncBusinessDateTasklet syncBusinessDateTasklet) {
+        return new JobBuilder(JobName.SYNC_BUSINESS_DATE_TO_SYSTEM_DATE.name(), jobRepository)
+                .start(syncBusinessDateStep(syncBusinessDateTasklet)).incrementer(new RunIdIncrementer()).build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/businessdate/jobs/syncbusinessdate/SyncBusinessDateTasklet.java

@@ -0,0 +1,88 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.businessdate.jobs.syncbusinessdate;
+
+import java.time.LocalDate;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.businessdate.data.service.BusinessDateDTO;
+import org.apache.fineract.infrastructure.businessdate.domain.BusinessDateType;
+import org.apache.fineract.infrastructure.businessdate.service.BusinessDateWritePlatformService;
+import org.apache.fineract.infrastructure.configuration.domain.ConfigurationDomainService;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.springframework.batch.core.StepContribution;
+import org.springframework.batch.core.scope.context.ChunkContext;
+import org.springframework.batch.core.step.tasklet.Tasklet;
+import org.springframework.batch.repeat.RepeatStatus;
+import org.springframework.stereotype.Component;
+
+/**
+ * Sets the business date to the tenant's own calendar date, every midnight.
+ *
+ * <p>
+ * Fineract's stock job adds one day to whatever the business date already holds. That is only the
+ * same thing as "today" while the scheduler has never missed a night: a server stopped over a
+ * weekend, a laptop that was closed, a tenant restored from an older backup, and the date is left
+ * behind by however many runs did not happen. It then stays behind, because adding a day to a stale
+ * date gives another stale date, and each night's run preserves the gap rather than closing it.
+ *
+ * <p>
+ * Drift is not a cosmetic problem. Every transaction is stamped with the business date, so while it
+ * lags: a Demand Draft raised today is rejected as being dated in the future, the day's savings
+ * interest never accrues and a closure pays out short, and staff see yesterday's date on work they
+ * are doing now.
+ *
+ * <p>
+ * Reading the clock instead of incrementing is self-correcting: however many days were missed, the
+ * next run lands on today. Bringing the date forward is all this does — a date deliberately set
+ * ahead, which is how testing against a future day works, is left alone rather than pulled back
+ * under someone's feet.
+ */
+@Slf4j
+@RequiredArgsConstructor
+@Component
+public class SyncBusinessDateTasklet implements Tasklet {
+
+    private final BusinessDateWritePlatformService businessDateWritePlatformService;
+    private final ConfigurationDomainService configurationDomainService;
+
+    @Override
+    public RepeatStatus execute(final StepContribution contribution, final ChunkContext chunkContext) {
+        if (!configurationDomainService.isBusinessDateEnabled()) {
+            // Without the setting on, the platform reads the clock directly and m_business_date is
+            // not consulted — writing to it would be busywork that misleads anyone reading the table.
+            log.debug("Business date is not enabled; nothing to sync.");
+            return RepeatStatus.FINISHED;
+        }
+
+        final LocalDate systemDate = DateUtils.getLocalDateOfTenant();
+        final LocalDate businessDate = DateUtils.getBusinessLocalDate();
+
+        if (!businessDate.isBefore(systemDate)) {
+            log.debug("Business date {} is already at or ahead of the system date {}; leaving it alone.", businessDate, systemDate);
+            return RepeatStatus.FINISHED;
+        }
+
+        businessDateWritePlatformService.updateBusinessDate(BusinessDateDTO.builder().type(BusinessDateType.BUSINESS_DATE)
+                .description(BusinessDateType.BUSINESS_DATE.getDescription()).date(systemDate).build());
+
+        log.info("Business date moved from {} to the system date {}.", businessDate, systemDate);
+        return RepeatStatus.FINISHED;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/SecurityConfig.java

@@ -33,6 +33,7 @@ import org.apache.fineract.infrastructure.configuration.domain.ConfigurationDoma
 import org.apache.fineract.infrastructure.core.domain.FineractRequestContextHolder;
 import org.apache.fineract.infrastructure.core.filters.CallerIpTrackingFilter;
 import org.apache.fineract.infrastructure.core.filters.CorrelationHeaderFilter;
+import org.apache.fineract.infrastructure.core.filters.DisabledFeatureApiFilter;
 import org.apache.fineract.infrastructure.core.filters.IdempotencyStoreFilter;
 import org.apache.fineract.infrastructure.core.filters.IdempotencyStoreHelper;
 import org.apache.fineract.infrastructure.core.filters.RequestResponseFilter;
@@ -163,6 +164,26 @@ public class SecurityConfig {
                     // packages here without a Fineract Bearer token; security is enforced by the
                     // envelope's RSA signature/encryption (NpciCryptoUtil) inside the handler.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/npci/**")).permitAll()
+                    // Client account summary, third-party callers — a partner integration calls this
+                    // with an X-Api-Key header instead of a Fineract username/password. The key itself
+                    // is issued by inserting directly into m_api_client in the tenant-store database
+                    // (see ApiClientAdminApiResource — its POST /v1/apiclients is deliberately disabled,
+                    // since any bank's own super user reaching it could mint a platform-wide key). Same
+                    // posture as IMPS/NPCI above: the outer gate stays open for this one narrow GET path, and
+                    // ClientAllAccountsApiResource#retrieveByClientNo is what actually authenticates
+                    // the caller (ApiClientCredentialService checks the key's hash, active flag and
+                    // IP allowlist) — a request with no key and no Fineract login still gets nothing,
+                    // it just fails inside the handler instead of at this filter.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/clientaccounts/**")).permitAll()
+                    // Tenant menu access — same dual-mode X-Api-Key posture as clientaccounts above
+                    // for the two GETs (TenantMenuAccessApiResource#read still requires an ordinary
+                    // session when no key is sent, same as ClientAllAccountsApiResource does; permitAll
+                    // here only opens Spring Security's outer gate for the key path, it does not skip
+                    // the handler's own check). The PUT has no session fallback inside the handler at
+                    // all, even for a logged-in super user — see TenantMenuAccessApiResource#save.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/tenant-menu-access")).permitAll()
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/tenant-menu-access/tenants")).permitAll()
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/tenant-menu-access")).permitAll()
                     // Login OTP — same posture as PAN/GSTIN public verification: provider-credentialed,
                     // no Fineract auth required.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/login/otp/generate")).permitAll()
@@ -203,7 +224,10 @@ public class SecurityConfig {
                     // currency
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/currencies"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_CURRENCY")
-                    .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/currencies"))
+                    // the actual currency-update endpoint is PUT (CurrenciesApiResource has no @POST method) -
+                    // this matcher previously targeted POST, which meant PUT fell through to the generic
+                    // fullyAuthenticated() catch-all with no permission check at all.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/currencies"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_CURRENCY")
                     // notes: read
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/clients/*/notes"))
@@ -336,11 +360,18 @@ public class SecurityConfig {
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/import/*"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_IMPORT")
                     // payment type
+                    // NOTE: POST previously required "UPDATE_PAYMENTTYPE" (wrong authority for create), with a
+                    // second, unreachable matcher for the same POST pattern requiring "DELETE_PAYMENTTYPE" - and
+                    // no PUT/DELETE matcher existed at all, so those requests fell through to the generic
+                    // fullyAuthenticated() catch-all below with no permission check. Corrected to one matcher
+                    // per method, each requiring its own correct permission code.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/paymenttypes/*"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_PAYMENTTYPE")
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/paymenttypes"))
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "CREATE_PAYMENTTYPE")
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/paymenttypes/*"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_PAYMENTTYPE")
-                    .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/paymenttypes"))
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.DELETE, "/api/*/paymenttypes/*"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "DELETE_PAYMENTTYPE")
                     // mix: taxonomy
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/mixtaxonomy/*"))
@@ -371,12 +402,41 @@ public class SecurityConfig {
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.DELETE, "/api/*/mixreport/*"))
                     .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "DELETE_MIX_REPORT")
                     // working days
+                    // NOTE: previously "READ_WORKING_DAYS"/"UPDATE_WORKING_DAYS" (with an underscore between
+                    // WORKING and DAYS), which did not match the actual seeded permission codes
+                    // (READ_WORKINGDAYS / UPDATE_WORKINGDAYS) - corrected to the real codes.
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/workingdays"))
-                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_WORKING_DAYS")
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_WORKINGDAYS")
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.GET, "/api/*/workingdays/template"))
-                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_WORKING_DAYS")
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_READ, "READ_WORKINGDAYS")
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/workingdays"))
-                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_WORKING_DAYS")
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_WORKINGDAYS")
+                    // sponsor banks
+                    // NOTE: no matcher previously existed at all for this path - POST/PUT both fell
+                    // through to the generic fullyAuthenticated() catch-all below with no permission
+                    // check whatsoever.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/sponsorbanks"))
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "CREATE_SPONSORBANK")
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/sponsorbanks/*"))
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_SPONSORBANK")
+                    // sponsor DD GST/GL settings
+                    // NOTE: no matcher previously existed at all for this path either. gl-mapping is a
+                    // genuine upsert (one call both creates and updates the single settings row), so it is
+                    // covered by one UPDATE_SPONSORDDGLMAPPING matcher rather than a separate CREATE one.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/sponsordd/gl-mapping"))
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_SPONSORDDGLMAPPING")
+                    // bank profile (institution profile)
+                    // NOTE: no matcher previously existed at all for this path - the PUT relied solely on
+                    // the in-resource validateHasPermissionTo() check, which this change replaces with the
+                    // command-source pipeline. Added here for the same defense-in-depth already applied to
+                    // Currency/Payment Type/Working Days.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/institutionprofile"))
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_INSTITUTIONPROFILE")
+                    // branch profile
+                    // NOTE: no matcher previously existed at all for this path either, same rationale as
+                    // institution profile above.
+                    .requestMatchers(API_MATCHER.matcher(HttpMethod.PUT, "/api/*/branchprofile/*"))
+                    .hasAnyAuthority(ALL_FUNCTIONS, ALL_FUNCTIONS_WRITE, "UPDATE_BRANCHPROFILE")
 
                     .requestMatchers(API_MATCHER.matcher(HttpMethod.POST, "/api/*/twofactor/validate")).fullyAuthenticated()
                     .requestMatchers(API_MATCHER.matcher("/api/*/twofactor")).fullyAuthenticated()
@@ -408,7 +468,10 @@ public class SecurityConfig {
                 .addFilterBefore(tenantAwareBasicAuthenticationFilter(), SecurityContextHolderFilter.class)
                 .addFilterAfter(requestResponseFilter(), ExceptionTranslationFilter.class)
                 .addFilterAfter(correlationHeaderFilter(), RequestResponseFilter.class)
-                .addFilterAfter(fineractInstanceModeApiFilter(), CorrelationHeaderFilter.class);
+                .addFilterAfter(fineractInstanceModeApiFilter(), CorrelationHeaderFilter.class)
+                // Refuses the handful of accounting features switched off for this installation.
+                // Nothing is deleted - see DisabledFeatureApiFilter for what is blocked and why.
+                .addFilterAfter(disabledFeatureApiFilter(), FineractInstanceModeApiFilter.class);
 
         if (loanCOBFilterHelper != null) {
             http.addFilterAfter(loanCOBApiFilter(), FineractInstanceModeApiFilter.class).addFilterAfter(idempotencyStoreFilter(),
@@ -445,6 +508,10 @@ public class SecurityConfig {
         return new RequestResponseFilter();
     }
 
+    public DisabledFeatureApiFilter disabledFeatureApiFilter() {
+        return new DisabledFeatureApiFilter();
+    }
+
     public LoanCOBApiFilter loanCOBApiFilter() {
         return new LoanCOBApiFilter(loanCOBFilterHelper);
     }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/filters/DisabledFeatureApiFilter.java

@@ -0,0 +1,128 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.core.filters;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import java.util.Set;
+import java.util.regex.Pattern;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+/**
+ * Turns off a handful of accounting features at the HTTP edge, without deleting any of the code
+ * behind them: the resources, services and command handlers all stay exactly as they are, and only
+ * an inbound API call is refused. Re-enabling a feature is deleting its rule from RULES below.
+ *
+ * Blocking here rather than inside the resources matters for one specific reason: several internal
+ * flows raise journal entries through CommandWrapperBuilder().createJournalEntry() in Java
+ * (ClerkDisbursementRequestApiResource's GL offsets, clerk closure rounding, bank transfers). Those
+ * never travel over HTTP, so they keep working, while the "Create Journal Entries" screen and any
+ * direct call to the endpoint are refused.
+ *
+ * A rule carries an optional set of allowed "command" query parameter values, because
+ * POST /v1/journalentries is three different features behind one path: no command is the manual
+ * journal entry screen (blocked), command=defineOpeningBalance is Migrate Opening Balances and
+ * command=updateRunningBalance is the running-balance maintenance job (both still needed).
+ */
+public class DisabledFeatureApiFilter extends OncePerRequestFilter {
+
+    private record Rule(String feature, Set<String> methods, Pattern path, Set<String> allowedCommands) {
+
+        boolean matches(final String method, final String pathInfo, final String command) {
+            if (!methods.isEmpty() && !methods.contains(method)) {
+                return false;
+            }
+            if (!path.matcher(pathInfo).matches()) {
+                return false;
+            }
+            // A command this rule explicitly spares (a different feature sharing the same path).
+            return !(command != null && allowedCommands.contains(command));
+        }
+    }
+
+    private static final List<Rule> RULES = List.of(
+            // Create Journal Entries, and Frequent Postings which posts through the same endpoint.
+            new Rule("Create Journal Entries", Set.of("POST"), Pattern.compile("/v[1-9][0-9]*/journalentries/?"),
+                    Set.of("defineOpeningBalance", "updateRunningBalance")),
+            // Closing Entries.
+            new Rule("Closing Entries", Set.of(), Pattern.compile("/v[1-9][0-9]*/glclosures(/.*)?"), Set.of()),
+            // Accruals.
+            new Rule("Accruals", Set.of(), Pattern.compile("/v[1-9][0-9]*/runaccruals(/.*)?"), Set.of()),
+            // Provisioning Entries, including the journal entries screen that belongs to it.
+            new Rule("Provisioning Entries", Set.of(), Pattern.compile("/v[1-9][0-9]*/provisioningentries(/.*)?"), Set.of()),
+            new Rule("Provisioning Entries", Set.of(), Pattern.compile("/v[1-9][0-9]*/journalentries/provisioning/?"), Set.of()),
+            // Accounting Rules. Only the Accounting Rules screens and Frequent Postings (disabled
+            // above) read these, so nothing still reachable depends on them.
+            new Rule("Accounting Rules", Set.of(), Pattern.compile("/v[1-9][0-9]*/accountingrules(/.*)?"), Set.of()));
+
+    @Override
+    protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain)
+            throws ServletException, IOException {
+
+        final String pathInfo = request.getPathInfo();
+        if (StringUtils.isBlank(pathInfo)) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        final String method = request.getMethod();
+        // Read "command" out of the query string rather than through getParameter(): the latter
+        // triggers servlet parameter parsing, which for a form-encoded or multipart POST consumes
+        // the request body before the resource ever sees it. This filter sits in front of every
+        // API call, so it must not touch the body of requests it has no interest in.
+        final String command = commandFromQueryString(request.getQueryString());
+        for (final Rule rule : RULES) {
+            if (rule.matches(method, pathInfo, command)) {
+                reject(response, rule.feature());
+                return;
+            }
+        }
+        filterChain.doFilter(request, response);
+    }
+
+    private String commandFromQueryString(final String queryString) {
+        if (StringUtils.isBlank(queryString)) {
+            return null;
+        }
+        for (final String pair : queryString.split("&")) {
+            if (pair.startsWith("command=")) {
+                return URLDecoder.decode(pair.substring("command=".length()), StandardCharsets.UTF_8);
+            }
+        }
+        return null;
+    }
+
+    private void reject(final HttpServletResponse response, final String feature) throws IOException {
+        response.setStatus(HttpStatus.SC_FORBIDDEN);
+        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+        response.getWriter()
+                .write("{\"developerMessage\":\"" + feature + " is disabled on this installation.\","
+                        + "\"httpStatusCode\":\"403\",\"defaultUserMessage\":\"" + feature + " is not available.\","
+                        + "\"userMessageGlobalisationCode\":\"error.msg.feature.disabled\"}");
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/service/JobSchedulerServiceImpl.java

@@ -66,6 +66,23 @@ public class JobSchedulerServiceImpl implements ApplicationListener<ContextRefre
             final List<ScheduledJobDetail> scheduledJobDetails = schedularWritePlatformService
                     .retrieveAllJobs(fineractProperties.getNodeId());
             for (final ScheduledJobDetail jobDetails : scheduledJobDetails) {
+                // Release any currently_running flag left over from before this boot.
+                //
+                // The flag is set in the scheduler's veto check before a job's body runs and cleared
+                // by the Quartz listener when it returns. Two things leave it set with nothing
+                // running: a JVM that stopped mid-run, and a job started through its own API rather
+                // than through Quartz — no listener is involved there, so nothing ever clears it.
+                //
+                // Once set, the veto silently drops every later trigger: no run-history row, no
+                // error, nothing in the log. The job reads as though it ran and did nothing, and one
+                // dead run mutes it for good. That is how a night of unpaid savings interest goes
+                // unnoticed.
+                //
+                // This loop is the platform coming up, so by definition none of these jobs is
+                // running: whatever the flag says, it is stale. scheduleJob() below already clears
+                // it on the paths it reaches, but not when it throws before that line, and the
+                // saveOrUpdate() after this loop persists whatever we set here either way.
+                jobDetails.setCurrentlyRunning(false);
                 try {
                     jobRegisterService.scheduleJob(jobDetails);
                 } catch (JobIsNotFoundOrNotEnabledException e) {

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/ApiClientAdminApiResource.java

@@ -0,0 +1,115 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.apiclient;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.springframework.stereotype.Component;
+
+/**
+ * Admin-only management of the third-party API keys {@link ApiClientCredentialService} authenticates.
+ * List/deactivate/reactivate still require a normal Fineract login restricted to a super user
+ * (ALL_FUNCTIONS) -- but minting a NEW key ({@link #create}) is disabled here entirely, on purpose.
+ *
+ * {@code ALL_FUNCTIONS} is a per-TENANT role grant -- and {@code TenantMenuAccessApiResource}'s whole
+ * point is that a bank's own super user (or a role simply misconfigured to carry ALL_FUNCTIONS, as the
+ * "Clerk" role was found to in two tenants this session) must never be able to lift its own menu-access
+ * ceiling. If this endpoint minted keys for any ALL_FUNCTIONS holder, that same bank super user could
+ * call {@code POST /v1/apiclients} and hand themselves a brand-new platform-operator credential -- one
+ * that authenticates against every tenant, not just their own -- completely bypassing the ceiling this
+ * key mechanism exists to enforce. A super user being able to read/deactivate the client list is fine
+ * (visibility and revocation are not privilege escalation); being able to mint a fresh one is exactly
+ * the escalation path being closed. New keys are issued the same way this fix issued the first one: a
+ * direct insert into {@code m_api_client} (see {@link ApiClientCredentialService#createClient}), by
+ * whoever already has direct database access -- never over HTTP.
+ */
+@Path("/v1/apiclients")
+@Component
+@Tag(name = "API Client Keys", description = "Admin management of third-party API keys used by endpoints that skip Fineract login.")
+@RequiredArgsConstructor
+public class ApiClientAdminApiResource {
+
+    private final PlatformSecurityContext context;
+    private final ApiClientCredentialService credentialService;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    /** Disabled -- see the class comment. Minting a key is a direct-database operation only. */
+    @POST
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public String create(final String body) {
+        requireSuperUser();
+        throw new WebApplicationException(Response.status(403)
+                .entity("{\"message\":\"Minting a new platform API key over HTTP is disabled. "
+                        + "Insert directly into m_api_client in the tenant-store database instead.\"}")
+                .type(MediaType.APPLICATION_JSON).build());
+    }
+
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public String list() {
+        requireSuperUser();
+        final List<Map<String, Object>> clients = credentialService.listClients();
+        return gson.toJson(clients);
+    }
+
+    @DELETE
+    @Path("/{id}")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String deactivate(@PathParam("id") final Long id) {
+        requireSuperUser();
+        credentialService.setActive(id, false);
+        return gson.toJson(Map.of("resourceId", id, "isActive", false));
+    }
+
+    @POST
+    @Path("/{id}/reactivate")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String reactivate(@PathParam("id") final Long id) {
+        requireSuperUser();
+        credentialService.setActive(id, true);
+        return gson.toJson(Map.of("resourceId", id, "isActive", true));
+    }
+
+    private AppUser requireSuperUser() {
+        final AppUser user = context.authenticatedUser();
+        if (!user.hasAnyPermission("ALL_FUNCTIONS")) {
+            throw new WebApplicationException(Response.status(403)
+                    .entity("{\"message\":\"Only a super user can manage third-party API keys.\"}").type(MediaType.APPLICATION_JSON)
+                    .build());
+        }
+        return user;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/ApiClientCredentialService.java

@@ -0,0 +1,243 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.apiclient;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import javax.sql.DataSource;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Authenticates third-party callers of endpoints that are meant to be reachable WITHOUT a Fineract user
+ * login -- an {@code X-Api-Key} header instead of a username/password. Same posture already used in this
+ * fork for the IMPS and NPCI receivers ({@code SecurityConfig}: those paths are {@code permitAll()} at
+ * the Spring Security layer, and the handler itself verifies the caller's credential): the outer gate
+ * stays open for the specific path, and this class is the thing that actually decides "yes" or "no".
+ *
+ * {@code m_api_client} lives in the tenant-STORE database ({@code fineract_tenants}), reached here via
+ * the {@code hikariTenantDataSource}-qualified {@link DataSource} -- the same bean
+ * {@code TenantDatabaseUpgradeService} uses to manage that database -- rather than the ordinary
+ * tenant-routed {@code JdbcTemplate} every other resource in this fork injects. That is deliberate, not
+ * an oversight: a key is a caller's identity, independent of which bank's data a given request is asking
+ * for, so one minted key must keep working against every tenant that exists now AND every one
+ * provisioned later. A copy of this table inside each bank's own tenant database would need a manual
+ * re-insert on every new bank, and every key would still need one row per tenant -- exactly what storing
+ * it centrally, once, avoids. {@code Fineract-Platform-TenantId} keeps doing what it always did (routes
+ * the REST of the request, e.g. {@code ClientAllAccountsApiResource}'s own client/account lookups, to
+ * the right bank's database) -- this class only ever touches the one central table.
+ *
+ * Security properties, deliberately:
+ * <ul>
+ * <li>Only a SHA-256 hash of the key is ever stored ({@code m_api_client.api_key_hash}). A leaked
+ * database backup can never be turned back into a usable credential -- the same reason Fineract itself
+ * never stores a user's plaintext password.</li>
+ * <li>The raw key is shown to the caller (well, the admin minting it) exactly once, at creation. It is
+ * not retrievable afterwards, by design -- if it's lost, the only recourse is to mint a new one and
+ * deactivate the old.</li>
+ * <li>{@code authenticate()} raises the SAME 401 message ("Invalid or inactive API key.") whether the key
+ * doesn't exist, is deactivated, or the caller's IP isn't on its allowlist -- so a probing attacker
+ * cannot use the response to tell a wrong key apart from a valid-but-blocked one.</li>
+ * <li>The IP allowlist is a plain comma-separated exact-match list, not CIDR ranges -- adequate for a
+ * small, known set of partner integrations; if a partner calls from a rotating pool of addresses, leave
+ * {@code allowedIps} null for that key rather than trying to enumerate every address.</li>
+ * </ul>
+ */
+@Component
+@RequiredArgsConstructor
+public class ApiClientCredentialService {
+
+    private static final String GENERIC_AUTH_FAILURE = "Invalid or inactive API key.";
+    // Enough random bytes that guessing is infeasible (256 bits) -- the same order of magnitude as a
+    // session token, appropriate for a credential that never expires on its own.
+    private static final int KEY_ENTROPY_BYTES = 32;
+
+    @Qualifier("hikariTenantDataSource")
+    private final DataSource tenantStoreDataSource;
+    private final SecureRandom secureRandom = new SecureRandom();
+
+    // Built once from the qualified DataSource in @PostConstruct rather than injected directly as a
+    // JdbcTemplate: @RequiredArgsConstructor only wires constructor parameters straight from fields,
+    // and JdbcTemplate itself isn't a bean registered under this qualifier -- only the DataSource is.
+    private JdbcTemplate tenantStoreJdbc;
+
+    @PostConstruct
+    void init() {
+        this.tenantStoreJdbc = new JdbcTemplate(tenantStoreDataSource);
+    }
+
+    /**
+     * Validates a raw {@code X-Api-Key} header value. On success, returns the registered client's
+     * display name (for the caller to log/attribute the request to) and records this call -- including
+     * which tenant it was made against -- as the key's most recent use. On any failure, throws a clean
+     * 401; the caller never gets far enough to tell a wrong key from a deactivated one or a blocked IP.
+     */
+    public String authenticate(final String rawApiKey, final String callerIp) {
+        if (StringUtils.isBlank(rawApiKey)) {
+            throw unauthorized();
+        }
+        final String hash = sha256Hex(rawApiKey);
+        final List<Map<String, Object>> rows = tenantStoreJdbc.queryForList("""
+                SELECT id, client_name, is_active, allowed_ips FROM m_api_client WHERE api_key_hash = ?
+                """, hash);
+        if (rows.isEmpty()) {
+            throw unauthorized();
+        }
+        final Map<String, Object> row = rows.get(0);
+        if (!Boolean.TRUE.equals(row.get("is_active"))) {
+            throw unauthorized();
+        }
+        final String allowedIps = (String) row.get("allowed_ips");
+        if (StringUtils.isNotBlank(allowedIps) && !isIpAllowed(allowedIps, callerIp)) {
+            throw unauthorized();
+        }
+
+        final Long id = ((Number) row.get("id")).longValue();
+        tenantStoreJdbc.update("UPDATE m_api_client SET last_used_at = ?, last_used_ip = ?, last_used_tenant = ? WHERE id = ?",
+                java.sql.Timestamp.from(Instant.now()), callerIp, currentTenantId(), id);
+
+        return (String) row.get("client_name");
+    }
+
+    private boolean isIpAllowed(final String allowedIps, final String callerIp) {
+        if (StringUtils.isBlank(callerIp)) {
+            return false;
+        }
+        return Arrays.stream(allowedIps.split(",")).map(String::trim).anyMatch(ip -> ip.equalsIgnoreCase(callerIp));
+    }
+
+    /**
+     * Admin operation: mints a new key and returns it in the response -- the ONLY time the raw value
+     * is ever available. {@code allowedIps} may be null/blank for no IP restriction. The resulting key
+     * authenticates against every tenant, regardless of which one the admin minting it happened to be
+     * logged into.
+     */
+    public Map<String, Object> createClient(final String clientName, final String allowedIps, final Long createdByUserId) {
+        if (StringUtils.isBlank(clientName)) {
+            throw badRequest("clientName is required.");
+        }
+        final String rawKey = generateRawKey();
+        final String hash = sha256Hex(rawKey);
+        final String prefix = rawKey.substring(0, Math.min(12, rawKey.length()));
+
+        final Long id = tenantStoreJdbc.queryForObject("""
+                INSERT INTO m_api_client (client_name, api_key_hash, api_key_prefix, allowed_ips, created_by, created_by_tenant)
+                VALUES (?,?,?,?,?,?)
+                RETURNING id
+                """, Long.class, clientName, hash, prefix, StringUtils.isBlank(allowedIps) ? null : allowedIps, createdByUserId,
+                currentTenantId());
+
+        final Map<String, Object> result = new LinkedHashMap<>();
+        result.put("id", id);
+        result.put("clientName", clientName);
+        result.put("apiKey", rawKey);
+        result.put("warning", "This is the only time the full API key is shown. Store it now -- it cannot be retrieved again.");
+        return result;
+    }
+
+    public List<Map<String, Object>> listClients() {
+        return tenantStoreJdbc.queryForList("""
+                SELECT id, client_name, api_key_prefix, is_active, allowed_ips,
+                       created_date, created_by_tenant, deactivated_date, last_used_at, last_used_ip, last_used_tenant
+                  FROM m_api_client ORDER BY created_date DESC
+                """);
+    }
+
+    public void setActive(final Long id, final boolean active) {
+        final int updated = tenantStoreJdbc.update(
+                "UPDATE m_api_client SET is_active = ?, deactivated_date = ? WHERE id = ?", active,
+                active ? null : java.sql.Timestamp.from(Instant.now()), id);
+        if (updated == 0) {
+            throw notFound("No API client with id " + id);
+        }
+    }
+
+    private String currentTenantId() {
+        try {
+            return ThreadLocalContextUtil.getTenant().getTenantIdentifier();
+        } catch (final RuntimeException e) {
+            // Defensive only: every request through SecurityConfig's matcher chain has a tenant
+            // resolved before it reaches here (see TenantAwareBasicAuthenticationFilter), so this
+            // should be unreachable in practice.
+            return null;
+        }
+    }
+
+    private String generateRawKey() {
+        final byte[] bytes = new byte[KEY_ENTROPY_BYTES];
+        secureRandom.nextBytes(bytes);
+        // URL-safe, no padding: safe to put directly in a header value with no further encoding.
+        return "cbsx_" + Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+    }
+
+    private String sha256Hex(final String raw) {
+        try {
+            final MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            final byte[] hashBytes = digest.digest(raw.getBytes(StandardCharsets.UTF_8));
+            final StringBuilder hex = new StringBuilder(hashBytes.length * 2);
+            for (final byte b : hashBytes) {
+                hex.append(String.format("%02x", b));
+            }
+            return hex.toString();
+        } catch (final NoSuchAlgorithmException e) {
+            // SHA-256 is a mandatory JCE algorithm on every JVM distribution Fineract supports --
+            // this can only mean a broken JVM install, not a recoverable runtime condition.
+            throw new IllegalStateException("SHA-256 is unavailable in this JVM", e);
+        }
+    }
+
+    private WebApplicationException unauthorized() {
+        // Naming the tenant the caller sent is safe here -- it is the header value they themselves
+        // put on the request, not something this check reveals to them -- and it turns "why did my
+        // key fail" from a guess into something checkable: was this call even reaching the bank the
+        // caller thought it was?
+        final String tenantId = currentTenantId();
+        final String message = tenantId != null ? GENERIC_AUTH_FAILURE + " (tenant: " + tenantId + ")" : GENERIC_AUTH_FAILURE;
+        return jsonError(401, message);
+    }
+
+    private WebApplicationException badRequest(final String message) {
+        return jsonError(400, message);
+    }
+
+    private WebApplicationException notFound(final String message) {
+        return jsonError(404, message);
+    }
+
+    private WebApplicationException jsonError(final int status, final String message) {
+        final String body = "{\"httpStatusCode\":\"" + status + "\",\"message\":\"" + message.replace("\"", "'") + "\"}";
+        return new WebApplicationException(Response.status(status).entity(body).type(MediaType.APPLICATION_JSON).build());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/apiclient/TenantMenuAccessApiResource.java

@@ -0,0 +1,214 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.apiclient;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonObject;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.fineract.infrastructure.core.domain.FineractPlatformTenant;
+import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
+import org.apache.fineract.infrastructure.core.service.tenant.TenantDetailsService;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+
+/**
+ * Which top-nav menu sections a tenant is allowed to ever show, regardless of what any role inside
+ * that tenant grants itself.
+ *
+ * {@code HasPermissionDirective} on the frontend already hides a menu item a user's own role lacks --
+ * but a role carrying {@code ALL_FUNCTIONS} (a super user, or a role simply misconfigured to hold it,
+ * as the "Clerk" role was found to in two tenants this session) bypasses that check unconditionally.
+ * A bank's own admin screen for roles and permissions therefore cannot be trusted as the only gate on
+ * "does this bank ever get to see the HRM/NPA/Admin section" -- whoever ends up with ALL_FUNCTIONS in
+ * that tenant, today or after some future role edit, would still see it. This table is the ceiling
+ * that check now also has to clear.
+ *
+ * Reading it accepts either credential (see {@link #read} below) -- a bank's own user needs their own
+ * tenant's list to render their nav correctly, the same way they already read their own permissions,
+ * and the platform operator needs to read ANY tenant's current list before toggling it. Writing it
+ * accepts only the platform's own {@code X-Api-Key} + {@link ApiClientCredentialService} credential --
+ * the same mechanism {@code ClientAllAccountsApiResource} uses for third-party callers, but with no
+ * session fallback at all here. That is deliberate -- a bank's own super user must never be able to
+ * lift its own ceiling by granting themselves a permission from inside their own tenant, which is
+ * exactly what a normal {@code ALL_FUNCTIONS} gate would allow. The key is minted once via
+ * {@code POST /v1/apiclients} by the platform operator and never handed to a bank.
+ */
+@Path("/v1/tenant-menu-access")
+@Component
+@Tag(name = "Tenant Menu Access",
+        description = "Per-tenant cap on which top-nav menu sections can ever be shown, independent of any role's own permissions. Read by any logged-in user of the tenant; written only via a platform-operator API key.")
+@RequiredArgsConstructor
+public class TenantMenuAccessApiResource {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final PlatformSecurityContext context;
+    private final ApiClientCredentialService apiClientCredentialService;
+    private final TenantDetailsService tenantDetailsService;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    private static final String[] IP_HEADER_CANDIDATES = { "X-Forwarded-For", "Proxy-Client-IP", "WL-Proxy-Client-IP" };
+
+    // The whole, fixed set of top-nav menu codes this screen knows about -- see 0541 for how this
+    // list was seeded. A write is only ever a PATCH over this table's existing rows (see save()); a
+    // code outside this set cannot be created by the API, so a typo in a request body is silently a
+    // no-op rather than junk data the frontend would then have to guard against.
+    private static final Set<String> KNOWN_MENU_CODES = Set.of("MENU_INSTITUTION", "SIDEBAR_CFCFRMS", "MENU_TASKS",
+            "MENU_CASHIER", "MENU_CLERK", "MENU_BRANCH_OPS", "MENU_CLEARING", "MENU_DEPOSITS", "MENU_ADVANCES",
+            "MENU_LOAN_ORIGINATION", "MENU_SHARE", "MENU_NPA", "MENU_GENERAL_LEDGER", "MENU_SUB_LEDGER", "MENU_ACCOUNTING",
+            "MENU_CKYC_MGMT", "MENU_INSURANCE", "MENU_DIGITAL", "MENU_HRM", "MENU_ADMIN", "MENU_RBI", "MENU_INVESTMENT",
+            "MENU_REPORTS", "MENU_OTHERS", "MENU_CONFIG_WIZARD", "MENU_CHEQUEBOOK", "MENU_LETTER_MGMT");
+
+    /**
+     * This tenant's own menu-access list, for the tenant named in {@code Fineract-Platform-TenantId}.
+     * Dual-mode read, same posture as {@code ClientAllAccountsApiResource}: an ordinary logged-in
+     * user reads their own tenant's list exactly like they already read their own permission list
+     * (no elevated permission required), or the platform operator reads ANY tenant's list with the
+     * API key, to know the current state before toggling it on their own control screen. Only the
+     * write side ({@link #save}) has no session fallback -- reading configuration is not sensitive,
+     * changing it is.
+     */
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    public String read(@HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest) {
+        if (StringUtils.isNotBlank(apiKey)) {
+            apiClientCredentialService.authenticate(apiKey, resolveClientIp(servletRequest));
+        } else {
+            context.authenticatedUser();
+        }
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList("SELECT menu_code, enabled FROM m_tenant_menu_access");
+        final JsonArray out = new JsonArray();
+        for (final Map<String, Object> row : rows) {
+            final JsonObject o = new JsonObject();
+            o.addProperty("menuCode", (String) row.get("menu_code"));
+            o.addProperty("enabled", Boolean.TRUE.equals(row.get("enabled")));
+            out.add(o);
+        }
+        return gson.toJson(out);
+    }
+
+    /**
+     * Every tenant configured on this platform, for the operator's own tenant picker -- always the
+     * master list from the tenant-store database, never the one tenant the caller's own
+     * {@code Fineract-Platform-TenantId} header happened to resolve to. That header still has to name
+     * a real tenant for the request to reach this handler at all (see
+     * {@code TenantAwareBasicAuthenticationFilter}); which one is otherwise irrelevant here.
+     */
+    @GET
+    @Path("/tenants")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String listTenants(@HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest) {
+        requireApiKey(apiKey, servletRequest);
+        final JsonArray out = new JsonArray();
+        for (final FineractPlatformTenant tenant : tenantDetailsService.findAllTenants()) {
+            final JsonObject o = new JsonObject();
+            o.addProperty("identifier", tenant.getTenantIdentifier());
+            o.addProperty("name", tenant.getName());
+            out.add(o);
+        }
+        return gson.toJson(out);
+    }
+
+    /**
+     * Sets which menu codes the tenant named in {@code Fineract-Platform-TenantId} may show, from the
+     * operator's own control screen. API key only -- see the class comment for why a normal session,
+     * even a super user's, is never accepted here.
+     *
+     * Body: {@code [{"menuCode": "MENU_HRM", "enabled": false}, ...]}. Only codes already in
+     * {@link #KNOWN_MENU_CODES} are written; anything else in the body is ignored rather than
+     * rejected, so the operator's screen can always send its full known set without first checking
+     * this deployment's exact backend version.
+     */
+    @PUT
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public String save(@HeaderParam("X-Api-Key") final String apiKey, @Context final HttpServletRequest servletRequest,
+            final String body) {
+        requireApiKey(apiKey, servletRequest);
+
+        final JsonArray entries = gson.fromJson(body, JsonArray.class);
+        if (entries == null) {
+            throw apiError(400, "Request body must be a JSON array of {menuCode, enabled}.");
+        }
+        final Set<String> touched = new LinkedHashSet<>();
+        for (final var el : entries) {
+            final JsonObject entry = el.getAsJsonObject();
+            if (!entry.has("menuCode") || entry.get("menuCode").isJsonNull()) {
+                continue;
+            }
+            final String menuCode = entry.get("menuCode").getAsString();
+            if (!KNOWN_MENU_CODES.contains(menuCode)) {
+                continue;
+            }
+            final boolean enabled = entry.has("enabled") && !entry.get("enabled").isJsonNull() && entry.get("enabled").getAsBoolean();
+            jdbcTemplate.update("UPDATE m_tenant_menu_access SET enabled = ? WHERE menu_code = ?", enabled, menuCode);
+            touched.add(menuCode);
+        }
+        final JsonObject res = new JsonObject();
+        res.addProperty("tenant", ThreadLocalContextUtil.getTenant().getTenantIdentifier());
+        res.addProperty("updated", touched.size());
+        return gson.toJson(res);
+    }
+
+    /** No session fallback, unlike every other API-key-capable endpoint in this codebase -- see the class comment. */
+    private void requireApiKey(final String apiKey, final HttpServletRequest servletRequest) {
+        if (StringUtils.isBlank(apiKey)) {
+            throw apiError(403, "This endpoint is only reachable with a platform operator API key.");
+        }
+        apiClientCredentialService.authenticate(apiKey, resolveClientIp(servletRequest));
+    }
+
+    private String resolveClientIp(final HttpServletRequest request) {
+        for (final String header : IP_HEADER_CANDIDATES) {
+            final String value = request.getHeader(header);
+            if (StringUtils.isNotBlank(value)) {
+                return value.split(",")[0].trim();
+            }
+        }
+        return request.getRemoteAddr();
+    }
+
+    private WebApplicationException apiError(final int httpStatus, final String message) {
+        final JsonObject body = new JsonObject();
+        body.addProperty("message", message);
+        body.addProperty("defaultUserMessage", message);
+        body.addProperty("httpStatus", httpStatus);
+        return new WebApplicationException(
+                Response.status(httpStatus).entity(gson.toJson(body)).type(MediaType.APPLICATION_JSON).build());
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/organisation/office/api/OfficesApiResource.java

@@ -29,6 +29,7 @@ import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.PUT;
@@ -200,6 +201,20 @@ public class OfficesApiResource {
         return toApiJsonSerializer.serialize(result);
     }
 
+    @DELETE
+    @Path("{officeId}")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Delete an Office", description = "Deletes an office outright. Fails if the office still has sub-offices, staff, clients, groups, users, or any other record attached to it.")
+    @ApiResponse(responseCode = "200", description = "OK")
+    public String deleteOffice(@PathParam("officeId") @Parameter(description = "officeId") final Long officeId) {
+        final CommandWrapper commandRequest = new CommandWrapperBuilder() //
+                .deleteOffice(officeId) //
+                .build();
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
+        return toApiJsonSerializer.serialize(result);
+    }
+
     @PUT
     @Path("/external-id/{externalId}")
     @Consumes({ MediaType.APPLICATION_JSON })

fineract-provider/src/main/java/org/apache/fineract/organisation/office/handler/DeleteOfficeCommandHandler.java

@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.organisation.office.handler;
+
+import org.apache.fineract.commands.annotation.CommandType;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.organisation.office.service.OfficeWritePlatformService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@CommandType(entity = "OFFICE", action = "DELETE")
+public class DeleteOfficeCommandHandler implements NewCommandSourceHandler {
+
+    private final OfficeWritePlatformService writePlatformService;
+
+    @Autowired
+    public DeleteOfficeCommandHandler(final OfficeWritePlatformService writePlatformService) {
+        this.writePlatformService = writePlatformService;
+    }
+
+    @Transactional
+    @Override
+    public CommandProcessingResult processCommand(final JsonCommand command) {
+
+        return this.writePlatformService.deleteOffice(command.entityId(), command);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/organisation/office/service/OfficeWritePlatformService.java

@@ -27,6 +27,8 @@ public interface OfficeWritePlatformService {
 
     CommandProcessingResult updateOffice(Long officeId, JsonCommand command);
 
+    CommandProcessingResult deleteOffice(Long officeId, JsonCommand command);
+
     CommandProcessingResult officeTransaction(JsonCommand command);
 
     CommandProcessingResult deleteOfficeTransaction(Long id, JsonCommand command);

fineract-provider/src/main/java/org/apache/fineract/organisation/office/service/OfficeWritePlatformServiceJpaRepositoryImpl.java

@@ -44,6 +44,7 @@ import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.Caching;
 import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.orm.jpa.JpaSystemException;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -57,6 +58,13 @@ public class OfficeWritePlatformServiceJpaRepositoryImpl implements OfficeWriteP
     private final OfficeRepositoryWrapper officeRepositoryWrapper;
     private final OfficeTransactionRepository officeTransactionRepository;
     private final ApplicationCurrencyRepositoryWrapper applicationCurrencyRepository;
+    // Lightweight existence checks ahead of delete -- m_office has ~30 tables with a foreign key back
+    // to it (clients, staff, GL entries, tellers, cheque stock, current accounts, ...); pulling in a
+    // repository for every one of them just to count rows would be a lot of new wiring for a check
+    // that is fundamentally "does anything point at this row". A handful of raw counts up front cover
+    // the cases a user can actually resolve themselves (move the clients, reassign the staff); the
+    // long tail that is left is caught by the try/catch around the delete itself.
+    private final JdbcTemplate jdbcTemplate;
 
     @Transactional
     @Override
@@ -147,6 +155,73 @@ public class OfficeWritePlatformServiceJpaRepositoryImpl implements OfficeWriteP
         }
     }
 
+    /**
+     * Deletes an office outright -- distinct from every other office command, which only ever changes
+     * status or fields. There is no "closed" state for an office the way there is for a client or a
+     * savings account, and no command handler ever implemented this, so the UI's "Remove" action always
+     * failed with a generic error no matter how empty the office was; the endpoint it called never
+     * existed.
+     *
+     * Checked up front, in the order a user could actually act on them: sub-offices first (the deepest
+     * structural block), then staff, clients and groups (the day-to-day reason an office still has
+     * anything in it), then any AppUser still homed there. Everything else that references m_office --
+     * GL journal entries, teller cash positions, cheque stock, current accounts, loan/savings
+     * transactions, and more -- is not spelled out here one table at a time; a real foreign-key
+     * violation on the delete itself is caught below and turned into one clear message instead. An
+     * office with real banking history behind it is not something this should make easy to remove either
+     * way, checked up front or not.
+     */
+    @Transactional
+    @Override
+    @Caching(evict = {
+            @CacheEvict(value = "offices", key = "T(org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil).getTenant().getTenantIdentifier().concat(#root.target.context.authenticatedUser().getOffice().getHierarchy()+'of')"),
+            @CacheEvict(value = "officesForDropdown", key = "T(org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil).getTenant().getTenantIdentifier().concat(#root.target.context.authenticatedUser().getOffice().getHierarchy()+'ofd')"),
+            @CacheEvict(value = "officesById", key = "T(org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil).getTenant().getTenantIdentifier().concat(#officeId)") })
+    public CommandProcessingResult deleteOffice(final Long officeId, final JsonCommand command) {
+
+        this.context.authenticatedUser();
+
+        final Office office = this.officeRepositoryWrapper.findOneWithNotFoundDetection(officeId);
+
+        requireNoneReference(officeId, "m_office", "parent_id", "sub-office", "sub-offices",
+                "Move or remove its sub-offices before deleting this office.");
+        requireNoneReference(officeId, "m_staff", "office_id", "staff member", "staff members",
+                "Reassign its staff to another office before deleting this office.");
+        requireNoneReference(officeId, "m_client", "office_id", "client", "clients",
+                "Transfer its clients to another office before deleting this office.");
+        requireNoneReference(officeId, "m_group", "office_id", "group", "groups",
+                "Transfer its groups to another office before deleting this office.");
+        requireNoneReference(officeId, "m_appuser", "office_id", "user", "users",
+                "Reassign the users homed at this office before deleting it.");
+
+        try {
+            this.officeRepositoryWrapper.deleteAndFlush(office);
+        } catch (final JpaSystemException | DataIntegrityViolationException dve) {
+            throw ErrorHandler.getMappable(dve, "error.msg.office.cannot.delete.has.references",
+                    "This office cannot be deleted: other records (accounts, transactions or history) still reference it.");
+        } catch (final PersistenceException dve) {
+            throw ErrorHandler.getMappable(dve, "error.msg.office.cannot.delete.has.references",
+                    "This office cannot be deleted: other records (accounts, transactions or history) still reference it.");
+        }
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .withEntityId(officeId) //
+                .withOfficeId(officeId) //
+                .build();
+    }
+
+    private void requireNoneReference(final Long officeId, final String table, final String column, final String singular,
+            final String plural, final String remedy) {
+        final Long count = this.jdbcTemplate.queryForObject("SELECT COUNT(*) FROM " + table + " WHERE " + column + " = ?", Long.class,
+                officeId);
+        if (count != null && count > 0) {
+            final String noun = count == 1 ? singular : plural;
+            throw new PlatformDataIntegrityException("error.msg.office.cannot.delete.still.referenced",
+                    "Office cannot be deleted: it has " + count + " " + noun + " attached. " + remedy, "officeId", officeId);
+        }
+    }
+
     @Transactional
     @Override
     public CommandProcessingResult officeTransaction(final JsonCommand command) {

fineract-provider/src/main/java/org/apache/fineract/organisation/office/starter/OrganisationOfficeConfiguration.java

@@ -56,9 +56,9 @@ public class OrganisationOfficeConfiguration {
             OfficeCommandFromApiJsonDeserializer fromApiJsonDeserializer,
             OfficeTransactionCommandFromApiJsonDeserializer moneyTransferCommandFromApiJsonDeserializer,
             OfficeRepositoryWrapper officeRepositoryWrapper, OfficeTransactionRepository officeTransactionRepository,
-            ApplicationCurrencyRepositoryWrapper applicationCurrencyRepository) {
+            ApplicationCurrencyRepositoryWrapper applicationCurrencyRepository, JdbcTemplate jdbcTemplate) {
         return new OfficeWritePlatformServiceJpaRepositoryImpl(context, fromApiJsonDeserializer,
                 moneyTransferCommandFromApiJsonDeserializer, officeRepositoryWrapper, officeTransactionRepository,
-                applicationCurrencyRepository);
+                applicationCurrencyRepository, jdbcTemplate);
     }
 }

fineract-provider/src/main/java/org/apache/fineract/organisation/workingdays/api/WorkingDaysApiResource.java

@@ -27,15 +27,15 @@ import jakarta.ws.rs.PUT;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
-import java.time.Instant;
-import java.util.function.Supplier;
 import lombok.RequiredArgsConstructor;
-import org.apache.fineract.command.core.CommandPipeline;
+import org.apache.fineract.commands.domain.CommandWrapper;
-import org.apache.fineract.organisation.workingdays.command.WorkingDaysUpdateCommand;
+import org.apache.fineract.commands.service.CommandWrapperBuilder;
+import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformService;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
 import org.apache.fineract.organisation.workingdays.data.WorkingDaysData;
 import org.apache.fineract.organisation.workingdays.data.WorkingDaysUpdateRequest;
 import org.apache.fineract.organisation.workingdays.data.WorkingDaysUpdateRequestValidator;
-import org.apache.fineract.organisation.workingdays.data.WorkingDaysUpdateResponse;
 import org.apache.fineract.organisation.workingdays.service.WorkingDaysReadPlatformService;
 import org.springframework.stereotype.Component;
 
@@ -50,7 +50,8 @@ public class WorkingDaysApiResource {
 
     private final WorkingDaysReadPlatformService workingDaysReadPlatformService;
     private final WorkingDaysUpdateRequestValidator workingDaysUpdateRequestValidator;
-    private final CommandPipeline commandPipeline;
+    private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
+    private final DefaultToApiJsonSerializer<WorkingDaysUpdateRequest> toApiJsonSerializer;
 
     @GET
     @Consumes({ MediaType.APPLICATION_JSON })
@@ -65,17 +66,13 @@ public class WorkingDaysApiResource {
     @Produces({ MediaType.APPLICATION_JSON })
     @Operation(summary = "Update a Working Day", description = "Mandatory Fields\n"
             + "recurrence,repaymentRescheduleType,extendTermForDailyRepayments,locale")
-    public WorkingDaysUpdateResponse update(@Valid WorkingDaysUpdateRequest request) {
+    public String update(@Valid final WorkingDaysUpdateRequest request) {
+        final CommandWrapper commandRequest = new CommandWrapperBuilder().updateWorkingDays()
+                .withJson(toApiJsonSerializer.serialize(request)).build();
 
-        final var command = new WorkingDaysUpdateCommand();
+        final CommandProcessingResult result = commandsSourceWritePlatformService.logCommandSource(commandRequest);
 
-        command.setCommandId(System.currentTimeMillis());
+        return toApiJsonSerializer.serialize(result);
-        command.setCreatedAt(Instant.now());
-        command.setPayload(request);
-
-        final Supplier<WorkingDaysUpdateResponse> response = commandPipeline.send(command);
-
-        return response.get();
     }
 
     @GET

fineract-provider/src/main/java/org/apache/fineract/organisation/workingdays/handler/UpdateWorkingDaysCommandHandler.java

@@ -18,38 +18,46 @@
  */
 package org.apache.fineract.organisation.workingdays.handler;
 
-import java.util.Collections;
 import java.util.Map;
-import lombok.RequiredArgsConstructor;
+import org.apache.fineract.commands.annotation.CommandType;
-import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.commands.handler.NewCommandSourceHandler;
-import org.apache.fineract.command.core.Command;
+import org.apache.fineract.infrastructure.core.api.JsonCommand;
-import org.apache.fineract.command.core.CommandHandler;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.organisation.workingdays.data.WorkingDaysUpdateRequest;
-import org.apache.fineract.organisation.workingdays.data.WorkingDaysUpdateResponse;
 import org.apache.fineract.organisation.workingdays.service.WorkingDaysWritePlatformService;
-import org.springframework.stereotype.Component;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-@Slf4j
+@Service
-@Component
+@CommandType(entity = "WORKINGDAYS", action = "UPDATE")
-@RequiredArgsConstructor
+public class UpdateWorkingDaysCommandHandler implements NewCommandSourceHandler {
-public class UpdateWorkingDaysCommandHandler implements CommandHandler<WorkingDaysUpdateRequest, WorkingDaysUpdateResponse> {
 
     private final WorkingDaysWritePlatformService workingDaysWritePlatformService;
 
+    @Autowired
+    public UpdateWorkingDaysCommandHandler(final WorkingDaysWritePlatformService workingDaysWritePlatformService) {
+        this.workingDaysWritePlatformService = workingDaysWritePlatformService;
+    }
+
     @Transactional
     @Override
-    public WorkingDaysUpdateResponse handle(Command<WorkingDaysUpdateRequest> command) {
+    public CommandProcessingResult processCommand(final JsonCommand command) {
-        WorkingDaysUpdateRequest request = command.getPayload();
-        Map<String, Object> changes = this.workingDaysWritePlatformService.updateWorkingDays(request);
-        if (changes == null) {
-            changes = Collections.emptyMap();
-        }
 
-        return WorkingDaysUpdateResponse.builder().resourceId((Long) changes.get("resourceId")).changes(changes)
+        final WorkingDaysUpdateRequest request = WorkingDaysUpdateRequest.builder()
-                .recurrence(request.getRecurrence()).repaymentRescheduleType(request.getRepaymentRescheduleType())
+                .recurrence(command.stringValueOfParameterNamed("recurrence"))
-                .extendTermForDailyRepayments(request.getExtendTermForDailyRepayments())
+                .repaymentRescheduleType(command.integerValueSansLocaleOfParameterNamed("repaymentRescheduleType"))
-                .extendTermForRepaymentsOnHolidays(request.getExtendTermForRepaymentsOnHolidays()).build();
+                .extendTermForDailyRepayments(command.booleanObjectValueOfParameterNamed("extendTermForDailyRepayments"))
+                .extendTermForRepaymentsOnHolidays(command.booleanObjectValueOfParameterNamed("extendTermForRepaymentsOnHolidays"))
+                .build();
+
+        final Map<String, Object> changes = this.workingDaysWritePlatformService.updateWorkingDays(request);
+
+        return new CommandProcessingResultBuilder() //
+                .withCommandId(command.commandId()) //
+                .with(changes) //
+                .build();
     }
 
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/account/service/AccountBookDebitService.java

@@ -0,0 +1,152 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.account.service;
+
+import java.math.BigDecimal;
+import java.sql.PreparedStatement;
+import java.time.LocalDate;
+import java.time.OffsetDateTime;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.UUID;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.exception.GeneralPlatformDomainRuleException;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
+import org.apache.fineract.portfolio.client.service.KycRestrictionGuard;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.support.GeneratedKeyHolder;
+import org.springframework.jdbc.support.KeyHolder;
+import org.springframework.stereotype.Service;
+
+/**
+ * A book debit: money leaves a savings or current account by book entry, not as cash.
+ *
+ * <p>
+ * Posts NO journal entry. The caller posts the one entry that describes the real movement (a DD, a collection...).
+ * Debiting through a cash withdrawal instead made the withdrawal post its own Dr control / Cr Cash-at-Vault entry --
+ * cash that never moved -- which callers then hid by flagging it reversed, leaving an entry in the ledger that no
+ * report shows.
+ *
+ * <p>
+ * It keeps the rules a withdrawal applies: the account must be active, the amount must fit in the available balance
+ * (balance less funds on hold), and a dormant account or a lapsed re-KYC stops the debit. Joins the caller's
+ * transaction, so a later failure rolls the debit back with everything else.
+ */
+@Service
+@RequiredArgsConstructor
+public class AccountBookDebitService {
+
+    private final JdbcTemplate jdbcTemplate;
+    private final KycRestrictionGuard kycRestrictionGuard;
+
+    /** Debits a savings account; returns the m_savings_account_transaction id. */
+    public long debitSavings(final Long accountId, final BigDecimal amount, final Long officeId, final LocalDate txnDate,
+            final Long userId) {
+        final BigDecimal balance = checkedBalance("m_savings_account", "Savings", accountId, amount);
+        kycRestrictionGuard.check(accountId, KycRestrictionGuard.Operation.DEBIT);
+
+        final java.sql.Date sqlDate = java.sql.Date.valueOf(txnDate);
+        final OffsetDateTime now = OffsetDateTime.now(DateUtils.getDateTimeZoneOfTenant());
+        final KeyHolder kh = new GeneratedKeyHolder();
+        jdbcTemplate.update(con -> {
+            final PreparedStatement ps = con.prepareStatement("INSERT INTO m_savings_account_transaction "
+                    + "(savings_account_id, office_id, payment_detail_id, transaction_type_enum, is_reversed, transaction_date, amount, "
+                    + "submitted_on_date, ref_no, running_balance_derived, is_lien_transaction, created_by, last_modified_by, "
+                    + "created_on_utc, last_modified_on_utc) VALUES (?, ?, NULL, 2, false, ?, ?, ?, ?, ?, false, ?, ?, ?, ?)",
+                    new String[] { "id" });
+            ps.setLong(1, accountId);
+            ps.setLong(2, officeId);
+            ps.setDate(3, sqlDate);
+            ps.setBigDecimal(4, amount);
+            ps.setDate(5, sqlDate);
+            ps.setString(6, refNo());
+            ps.setBigDecimal(7, balance.subtract(amount));
+            ps.setLong(8, userId);
+            ps.setLong(9, userId);
+            ps.setObject(10, now);
+            ps.setObject(11, now);
+            return ps;
+        }, kh);
+        jdbcTemplate.update("UPDATE m_savings_account SET account_balance_derived = account_balance_derived - ?, "
+                + "total_withdrawals_derived = COALESCE(total_withdrawals_derived, 0) + ? WHERE id = ?", amount, amount, accountId);
+        return Objects.requireNonNull(kh.getKey()).longValue();
+    }
+
+    /** Debits a current account; returns the m_current_account_transaction id. */
+    public long debitCurrent(final Long accountId, final BigDecimal amount, final Long officeId, final LocalDate txnDate,
+            final Long userId, final String note) {
+        final BigDecimal balance = checkedBalance("m_current_account", "Current", accountId, amount);
+        kycRestrictionGuard.checkCurrentAccount(accountId, KycRestrictionGuard.Operation.DEBIT);
+
+        final java.sql.Date sqlDate = java.sql.Date.valueOf(txnDate);
+        final String remarks = note == null || note.isBlank() ? "Book debit" : (note.length() > 490 ? note.substring(0, 490) : note);
+        final KeyHolder kh = new GeneratedKeyHolder();
+        jdbcTemplate.update(con -> {
+            final PreparedStatement ps = con.prepareStatement("INSERT INTO m_current_account_transaction "
+                    + "(current_account_id, office_id, transaction_type_enum, transaction_date, amount, is_reversed, is_reversal, "
+                    + "is_manual, is_lien_transaction, ref_no, submitted_on_date, running_balance_derived, remarks, created_date, created_by) "
+                    + "VALUES (?, ?, 2, ?, ?, false, false, false, false, ?, ?, ?, ?, CURRENT_TIMESTAMP, ?)", new String[] { "id" });
+            ps.setLong(1, accountId);
+            ps.setLong(2, officeId);
+            ps.setDate(3, sqlDate);
+            ps.setBigDecimal(4, amount);
+            ps.setString(5, refNo());
+            ps.setDate(6, sqlDate);
+            ps.setBigDecimal(7, balance.subtract(amount));
+            ps.setString(8, remarks);
+            ps.setLong(9, userId);
+            return ps;
+        }, kh);
+        jdbcTemplate.update("UPDATE m_current_account SET account_balance_derived = account_balance_derived - ?, "
+                + "total_withdrawals_derived = COALESCE(total_withdrawals_derived, 0) + ? WHERE id = ?", amount, amount, accountId);
+        return Objects.requireNonNull(kh.getKey()).longValue();
+    }
+
+    /** The account's balance, after checking it is active and can cover {@code amount} from what is not on hold. */
+    private BigDecimal checkedBalance(final String table, final String kind, final Long accountId, final BigDecimal amount) {
+        final List<Map<String, Object>> rows = jdbcTemplate.queryForList(
+                "SELECT status_enum, account_balance_derived, on_hold_funds_derived FROM " + table + " WHERE id = ?", accountId);
+        if (rows.isEmpty()) {
+            throw new GeneralPlatformDomainRuleException("error.msg.account.not.found", kind + " account " + accountId + " not found.",
+                    accountId);
+        }
+        final int status = ((Number) rows.get(0).get("status_enum")).intValue();
+        if (status != 300) {
+            throw new GeneralPlatformDomainRuleException("error.msg.account.not.active",
+                    kind + " account " + accountId + " is not active.", accountId);
+        }
+        final BigDecimal balance = rows.get(0).get("account_balance_derived") == null ? BigDecimal.ZERO
+                : (BigDecimal) rows.get(0).get("account_balance_derived");
+        final BigDecimal onHold = rows.get(0).get("on_hold_funds_derived") == null ? BigDecimal.ZERO
+                : (BigDecimal) rows.get(0).get("on_hold_funds_derived");
+        final BigDecimal available = balance.subtract(onHold);
+        if (available.compareTo(amount) < 0) {
+            throw new GeneralPlatformDomainRuleException("error.msg.account.insufficient.balance",
+                    "Insufficient available balance in " + kind.toLowerCase() + " account " + accountId + ". Available: " + available
+                            + ", Requested: " + amount,
+                    accountId);
+        }
+        return balance;
+    }
+
+    private static String refNo() {
+        return UUID.randomUUID().toString().replace("-", "").substring(0, 20);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/account/service/AccountTransfersWritePlatformServiceImpl.java

@@ -57,6 +57,7 @@ import org.apache.fineract.portfolio.account.domain.AccountTransferRepository;
 import org.apache.fineract.portfolio.account.domain.AccountTransferTransaction;
 import org.apache.fineract.portfolio.account.domain.AccountTransferType;
 import org.apache.fineract.portfolio.account.exception.DifferentCurrenciesException;
+import org.apache.fineract.portfolio.client.service.KycRestrictionGuard;
 import org.apache.fineract.portfolio.currentaccount.domain.CurrentAccount;
 import org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountRepository;
 import org.apache.fineract.portfolio.currentaccount.domain.CurrentAccountTransaction;
@@ -100,6 +101,7 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
     private final CurrentAccountRepository currentAccountRepository;
     private final CurrentAccountTransactionRepository currentAccountTransactionRepository;
     private final AccountingProcessorHelper accountingProcessorHelper;
+    private final KycRestrictionGuard kycRestrictionGuard;
 
     @Transactional
     @Override
@@ -472,7 +474,7 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
 
             final CurrentAccountTransaction withdrawal = performCurrentWithdrawal(fromCurrentAccount,
                     accountTransferDTO.getTransactionAmount(), accountTransferDTO.getTransactionDate(),
-                    toSavingsAccount.productId(), toSavingsAccount.getId());
+                    toSavingsAccount.productId(), false, toSavingsAccount.getId());
 
             // skipAccountingPostings=true: current account withdrawal leg (C-txn) already posts
             // DR CURRENT ACCOUNT / CR SAVING INDIVIDUAL directly — each with its own account number.
@@ -517,7 +519,7 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
 
             performCurrentDeposit(toCurrentAccount, accountTransferDTO.getTransactionAmount(),
                     accountTransferDTO.getTransactionDate(),
-                    fromSavingsAccount.productId(), fromSavingsAccount.getId());
+                    fromSavingsAccount.productId(), false, fromSavingsAccount.getId());
 
             if (accountTransferDetails == null) {
                 accountTransferDetails = AccountTransferDetails.savingsToCurrentTransfer(
@@ -545,10 +547,10 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
 
             performCurrentWithdrawal(fromCurrentAccount, accountTransferDTO.getTransactionAmount(),
                     accountTransferDTO.getTransactionDate(),
-                    toCurrentAccount.getProductId(), toCurrentAccount.getId());
+                    toCurrentAccount.getProductId(), true, toCurrentAccount.getId());
             performCurrentDeposit(toCurrentAccount, accountTransferDTO.getTransactionAmount(),
                     accountTransferDTO.getTransactionDate(),
-                    fromCurrentAccount.getProductId(), fromCurrentAccount.getId());
+                    fromCurrentAccount.getProductId(), true, fromCurrentAccount.getId());
 
             if (accountTransferDetails == null) {
                 accountTransferDetails = AccountTransferDetails.currentToCurrentTransfer(
@@ -681,6 +683,8 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
      */
     private CurrentAccountTransaction performCurrentWithdrawalForLoan(final CurrentAccount account, final BigDecimal amount,
             final LocalDate txnDate) {
+        // Money leaving a current account by transfer is refused on a dormant one, as a withdrawal is.
+        kycRestrictionGuard.checkCurrentAccount(account.getId(), KycRestrictionGuard.Operation.TRANSFER);
         final BigDecimal balance = account.getAccountBalanceDerived() != null ? account.getAccountBalanceDerived() : BigDecimal.ZERO;
         final BigDecimal onHold = account.getOnHoldFundsDerived() != null ? account.getOnHoldFundsDerived() : BigDecimal.ZERO;
         final BigDecimal available = balance.subtract(onHold);
@@ -699,10 +703,9 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
         currentAccountRepository.save(account);
         if (account.getProductId() != null && txn.getId() != null) {
             final String currentTxnId = "CA" + txn.getId();
-            accountingProcessorHelper.createCashBasedJournalEntriesAndReversalsForSavings(account.getOffice(),
+            accountingProcessorHelper.createCurrentControlToFinancialActivityJournalEntries(account.getOffice(),
-                    account.getCurrencyCode(), CashAccountsForSavings.SAVINGS_CONTROL.getValue(),
+                    account.getCurrencyCode(), account.getProductId(), FinancialActivity.LIABILITY_TRANSFER.getValue(),
-                    FinancialActivity.LIABILITY_TRANSFER.getValue(), account.getProductId(), null,
+                    account.getId(), currentTxnId, txnDate, amount);
-                    account.getId(), currentTxnId, txnDate, amount, false);
         }
         return txn;
     }
@@ -712,7 +715,9 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
      * Throws {@link GeneralPlatformDomainRuleException} if balance is insufficient.
      */
     private CurrentAccountTransaction performCurrentWithdrawal(final CurrentAccount account, final BigDecimal amount,
-            final LocalDate txnDate, final Long counterpartProductId, final Long counterpartEntityId) {
+            final LocalDate txnDate, final Long counterpartProductId, final boolean counterpartIsCurrent,
+            final Long counterpartEntityId) {
+        kycRestrictionGuard.checkCurrentAccount(account.getId(), KycRestrictionGuard.Operation.TRANSFER);
         final BigDecimal balance = account.getAccountBalanceDerived() != null ? account.getAccountBalanceDerived() : BigDecimal.ZERO;
         final BigDecimal onHold = account.getOnHoldFundsDerived() != null ? account.getOnHoldFundsDerived() : BigDecimal.ZERO;
         final BigDecimal available = balance.subtract(onHold);
@@ -730,7 +735,8 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
                 (account.getTotalWithdrawalsDerived() != null ? account.getTotalWithdrawalsDerived() : BigDecimal.ZERO).add(amount));
         currentAccountRepository.save(account);
         // Post journal entries: DR current account GL, CR counterpart GL — each with correct entity/account number
-        postCurrentAccountTransferJournalEntries(account, txn, amount, txnDate, true, counterpartProductId, counterpartEntityId);
+        postCurrentAccountTransferJournalEntries(account, txn, amount, txnDate, true, counterpartProductId, counterpartIsCurrent,
+                counterpartEntityId);
         return txn;
     }
 
@@ -738,7 +744,9 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
      * Deposit amount into a current account and save the transaction.
      */
     private CurrentAccountTransaction performCurrentDeposit(final CurrentAccount account, final BigDecimal amount,
-            final LocalDate txnDate, final Long counterpartProductId, final Long counterpartEntityId) {
+            final LocalDate txnDate, final Long counterpartProductId, final boolean counterpartIsCurrent,
+            final Long counterpartEntityId) {
+        kycRestrictionGuard.checkCurrentAccount(account.getId(), KycRestrictionGuard.Operation.CREDIT);
         final BigDecimal balance = account.getAccountBalanceDerived() != null ? account.getAccountBalanceDerived() : BigDecimal.ZERO;
         final CurrentAccountTransaction txn = CurrentAccountTransaction.deposit(account, account.getOffice(), amount, txnDate, null);
         final BigDecimal newBalance = balance.add(amount);
@@ -749,7 +757,8 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
                 (account.getTotalDepositsDerived() != null ? account.getTotalDepositsDerived() : BigDecimal.ZERO).add(amount));
         currentAccountRepository.save(account);
         // Post journal entries: DR counterpart GL, CR current account GL — each with correct entity/account number
-        postCurrentAccountTransferJournalEntries(account, txn, amount, txnDate, false, counterpartProductId, counterpartEntityId);
+        postCurrentAccountTransferJournalEntries(account, txn, amount, txnDate, false, counterpartProductId, counterpartIsCurrent,
+                counterpartEntityId);
         return txn;
     }
 
@@ -783,7 +792,7 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
      */
     private void postCurrentAccountTransferJournalEntries(final CurrentAccount account, final CurrentAccountTransaction txn,
             final BigDecimal amount, final LocalDate txnDate, final boolean isWithdrawal,
-            final Long counterpartProductId, final Long counterpartEntityId) {
+            final Long counterpartProductId, final boolean counterpartIsCurrent, final Long counterpartEntityId) {
         if (account.getProductId() == null || txn.getId() == null) {
             return;
         }
@@ -794,17 +803,13 @@ public class AccountTransfersWritePlatformServiceImpl implements AccountTransfer
         final String currentTxnId = "CA" + txn.getId();
         if (isWithdrawal) {
             // DR: current account GL  CR: counterpart (savings/current) GL
-            accountingProcessorHelper.createDirectTransferJournalEntriesForSavings(
+            accountingProcessorHelper.createDirectTransferJournalEntries(account.getOffice(), account.getCurrencyCode(),
-                    account.getOffice(), account.getCurrencyCode(),
+                    account.getProductId(), true, account.getId(), counterpartProductId, counterpartIsCurrent, counterpartEntityId,
-                    account.getProductId(), account.getId(),
-                    counterpartProductId, counterpartEntityId,
                     currentTxnId, txnDate, amount);
         } else {
             // DR: counterpart (savings/current) GL  CR: current account GL
-            accountingProcessorHelper.createDirectTransferJournalEntriesForSavings(
+            accountingProcessorHelper.createDirectTransferJournalEntries(account.getOffice(), account.getCurrencyCode(),
-                    account.getOffice(), account.getCurrencyCode(),
+                    counterpartProductId, counterpartIsCurrent, counterpartEntityId, account.getProductId(), true, account.getId(),
-                    counterpartProductId, counterpartEntityId,
-                    account.getProductId(), account.getId(),
                     currentTxnId, txnDate, amount);
         }
     }

fineract-provider/src/main/java/org/apache/fineract/portfolio/account/starter/AccountConfiguration.java

@@ -37,6 +37,7 @@ import org.apache.fineract.portfolio.account.domain.AccountTransferRepository;
 import org.apache.fineract.portfolio.account.domain.StandingInstructionAssembler;
 import org.apache.fineract.portfolio.account.domain.StandingInstructionRepository;
 import org.apache.fineract.portfolio.account.mapper.AccountTransfersMapper;
+import org.apache.fineract.portfolio.client.service.KycRestrictionGuard;
 import org.apache.fineract.portfolio.account.service.AccountAssociationsReadPlatformService;
 import org.apache.fineract.portfolio.account.service.AccountAssociationsReadPlatformServiceImpl;
 import org.apache.fineract.portfolio.account.service.AccountTransfersReadPlatformService;
@@ -96,12 +97,12 @@ public class AccountConfiguration {
             GSIMRepositoy gsimRepository, ConfigurationDomainService configurationDomainService, ExternalIdFactory externalIdFactory,
             FineractProperties fineractProperties, CurrentAccountRepository currentAccountRepository,
             CurrentAccountTransactionRepository currentAccountTransactionRepository,
-            AccountingProcessorHelper accountingProcessorHelper) {
+            AccountingProcessorHelper accountingProcessorHelper, KycRestrictionGuard kycRestrictionGuard) {
         return new AccountTransfersWritePlatformServiceImpl(accountTransfersDataValidator, accountTransferAssembler,
                 accountTransferRepository, savingsAccountAssembler, savingsAccountDomainService, loanAccountAssembler,
                 loanAccountDomainService, savingsAccountWritePlatformService, accountTransferDetailRepository, loanReadPlatformService,
                 gsimRepository, configurationDomainService, externalIdFactory, fineractProperties,
-                currentAccountRepository, currentAccountTransactionRepository, accountingProcessorHelper);
+                currentAccountRepository, currentAccountTransactionRepository, accountingProcessorHelper, kycRestrictionGuard);
     }
 
     @Bean

fineract-provider/src/main/java/org/apache/fineract/portfolio/accounts/constants/ShareAccountApiConstants.java

@@ -61,6 +61,8 @@ public interface ShareAccountApiConstants {
     String externalid_paramname = "externalId";
 
     String resolutionnumber_paramname = "resolutionNumber";
+    /** Date of the board meeting that passed the resolution. */
+    String resolutiondate_paramname = "resolutionDate";
 
     String currency_paramname = "currencyCode";
 
@@ -146,7 +148,7 @@ public interface ShareAccountApiConstants {
 
     Set<String> supportedParameters = Collections.unmodifiableSet(new HashSet<>(Arrays.asList(locale_paramname, dateformat_paramname,
             id_paramname, clientid_paramname, productid_paramname, submitteddate_paramname, approveddate_paramname, externalid_paramname,
-            resolutionnumber_paramname, currency_paramname, digitsafterdecimal_paramname, inmultiplesof_paramname,
+            resolutionnumber_paramname, resolutiondate_paramname, currency_paramname, digitsafterdecimal_paramname, inmultiplesof_paramname,
             requestedshares_paramname, savingsaccountid_paramname, lockinperiod_paramname, lockperiodfrequencytype_paramname,
             minimumactiveperiod_paramname, minimumactiveperiodfrequencytype_paramname,
             allowdividendcalculationforinactiveclients_paramname, charges_paramname, applicationdate_param, purchaseddate_paramname,

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AlertReviewRequest.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.aml.api;
 
+import java.util.List;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
@@ -30,4 +31,13 @@ public class AlertReviewRequest {
 
     private String disposition;
     private String notes;
+
+    /**
+     * The rules being decided, when the officer is deciding some of them rather than the whole alert.
+     *
+     * <p>
+     * Absent or empty means the decision covers the transaction and every rule it matched, which is what the row-level
+     * Whitelist and Suspicious buttons send and what this endpoint has always done.
+     */
+    private List<String> ruleCodes;
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlAlertApiResource.java

@@ -71,7 +71,13 @@ public class AmlAlertApiResource {
             description = "disposition WHITELIST closes the alert as a false positive; ESCALATE creates an STR case for Principal Officer review.")
     public String review(@PathParam("alertId") final Long alertId, final AlertReviewRequest request) {
         this.context.authenticatedUser().validateHasPermissionTo("REVIEW_AML_ALERT");
-        if ("ESCALATE".equalsIgnoreCase(request.getDisposition())) {
+        final boolean escalating = "ESCALATE".equalsIgnoreCase(request.getDisposition());
+        if (request.getRuleCodes() != null && !request.getRuleCodes().isEmpty()) {
+            // Deciding named rules within the alert. The alert's own status follows from what is left undecided, so
+            // it is not set here.
+            this.writePlatformService.reviewRules(alertId, request.getRuleCodes(), escalating ? "ESCALATE" : "WHITELIST",
+                    request.getNotes());
+        } else if (escalating) {
             this.writePlatformService.escalate(alertId, request.getNotes());
         } else {
             this.writePlatformService.whitelist(alertId, request.getNotes());

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/AmlCtrReportApiResource.java

@@ -25,6 +25,7 @@ import jakarta.ws.rs.GET;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.Path;
 import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import jakarta.ws.rs.core.MediaType;
 import java.time.YearMonth;
 import java.util.List;
@@ -32,6 +33,7 @@ import lombok.RequiredArgsConstructor;
 import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.aml.data.AmlCtrReportData;
+import org.apache.fineract.portfolio.aml.data.AmlCtrReportLineData;
 import org.apache.fineract.portfolio.aml.service.AmlCtrReportGenerationService;
 import org.apache.fineract.portfolio.aml.service.AmlCtrReportReadPlatformService;
 import org.springframework.stereotype.Component;
@@ -47,6 +49,7 @@ public class AmlCtrReportApiResource {
     private final AmlCtrReportReadPlatformService readPlatformService;
     private final AmlCtrReportGenerationService generationService;
     private final DefaultToApiJsonSerializer<AmlCtrReportData> toApiJsonSerializer;
+    private final DefaultToApiJsonSerializer<AmlCtrReportLineData> lineJsonSerializer;
 
     @GET
     @Consumes({ MediaType.APPLICATION_JSON })
@@ -58,6 +61,28 @@ public class AmlCtrReportApiResource {
         return this.toApiJsonSerializer.serialize(reports);
     }
 
+    @GET
+    @Path("lines")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "The reportable lines behind the generated CTRs",
+            description = "Each line resolved to the account, customer, branch and date a FIU-IND filing names. Optional reportId narrows it to one month.")
+    public String retrieveLines(@QueryParam("reportId") final Long reportId) {
+        this.context.authenticatedUser();
+        return this.lineJsonSerializer.serialize(this.readPlatformService.retrieveLines(reportId));
+    }
+
+    @GET
+    @Path("pending-lines")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Reportable cash transactions not yet in any generated CTR",
+            description = "The monthly batch is a snapshot, so a transaction posted after it ran belongs to that month's filing but sits in no report. These are those transactions, shaped as lines, so a reportable one is never invisible.")
+    public String retrievePendingLines() {
+        this.context.authenticatedUser();
+        return this.lineJsonSerializer.serialize(this.readPlatformService.retrievePendingLines());
+    }
+
     @POST
     @Path("generate")
     @Consumes({ MediaType.APPLICATION_JSON })

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/api/ClientRiskChangeApiResource.java

@@ -0,0 +1,172 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.api;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonObject;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import java.util.function.Supplier;
+import lombok.RequiredArgsConstructor;
+import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.aml.service.ClientRiskChangeRequestService;
+import org.springframework.stereotype.Component;
+
+/**
+ * Moving a customer's KYC risk category, under maker-checker.
+ *
+ * <p>
+ * Raised from the Risk Review Report, which already works out which customers are rated below what
+ * their behaviour warrants. The rating moves only when a checker approves, and the change is written
+ * into the customer's risk history with the reason given.
+ */
+@Path("/v1/aml/risk-change-requests")
+@Component
+@Tag(name = "Client Risk Category Change",
+        description = "Maker-checker changes to a customer's KYC risk category, raised from the Risk Review Report.")
+@RequiredArgsConstructor
+public class ClientRiskChangeApiResource {
+
+    private final PlatformSecurityContext context;
+    private final ClientRiskChangeRequestService service;
+    private final Gson gson = new GsonBuilder().serializeNulls().create();
+
+    /**
+     * Business-rule failures in this module are plain IllegalArgument/IllegalState exceptions, which
+     * Fineract's global handler does not map - left uncaught they reach the client as an opaque 500
+     * with no message. Wrapped so the reviewer is told what actually stopped them.
+     */
+    private <T> T safely(final Supplier<T> action) {
+        try {
+            return action.get();
+        } catch (final IllegalArgumentException | IllegalStateException e) {
+            throw apiError(400, e.getMessage());
+        }
+    }
+
+    private WebApplicationException apiError(final int httpStatus, final String message) {
+        final JsonObject body = new JsonObject();
+        body.addProperty("message", message);
+        body.addProperty("defaultUserMessage", message);
+        body.addProperty("httpStatus", httpStatus);
+        final JsonArray errors = new JsonArray();
+        final JsonObject err = new JsonObject();
+        err.addProperty("defaultUserMessage", message);
+        errors.add(err);
+        body.add("errors", errors);
+        return new WebApplicationException(
+                Response.status(httpStatus).entity(this.gson.toJson(body)).type(MediaType.APPLICATION_JSON).build());
+    }
+
+    @GET
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "List risk category change requests",
+            description = "Optionally filtered by status (PENDING/APPROVED/REJECTED) for the approval queue.")
+    public String retrieveAll(@QueryParam("status") final String status) {
+        this.context.authenticatedUser();
+        return this.gson.toJson(this.service.retrieveAll(status));
+    }
+
+    @POST
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Request a change to a customer's risk category",
+            description = "Maker step. Nothing moves until a checker approves.")
+    public CommandProcessingResult request(final RiskChangeRequest request) {
+        return safely(() -> this.service.request(request.getClientId(), request.getRequestedCategory(), request.getReason()));
+    }
+
+    @POST
+    @Path("{requestId}/approve")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Approve a risk category change",
+            description = "Checker step: applies the new category to the customer's KYC record, moves the re-KYC due date onto that category's cycle, and writes the change into the risk history.")
+    public CommandProcessingResult approve(@PathParam("requestId") final Long requestId) {
+        return safely(() -> this.service.approve(requestId));
+    }
+
+    @POST
+    @Path("{requestId}/reject")
+    @Consumes({ MediaType.APPLICATION_JSON })
+    @Produces({ MediaType.APPLICATION_JSON })
+    @Operation(summary = "Reject a risk category change", description = "Checker step. The customer's rating is left as it is.")
+    public CommandProcessingResult reject(@PathParam("requestId") final Long requestId, final RiskChangeRejectRequest request) {
+        return safely(() -> this.service.reject(requestId, request.getRejectionReason()));
+    }
+
+    /** Request bodies. Plain beans so Jackson binds them without a serializer of their own. */
+    public static final class RiskChangeRequest {
+
+        private Long clientId;
+        private Integer requestedCategory;
+        private String reason;
+
+        public Long getClientId() {
+            return clientId;
+        }
+
+        public void setClientId(Long clientId) {
+            this.clientId = clientId;
+        }
+
+        public Integer getRequestedCategory() {
+            return requestedCategory;
+        }
+
+        public void setRequestedCategory(Integer requestedCategory) {
+            this.requestedCategory = requestedCategory;
+        }
+
+        public String getReason() {
+            return reason;
+        }
+
+        public void setReason(String reason) {
+            this.reason = reason;
+        }
+    }
+
+    public static final class RiskChangeRejectRequest {
+
+        private String rejectionReason;
+
+        public String getRejectionReason() {
+            return rejectionReason;
+        }
+
+        public void setRejectionReason(String rejectionReason) {
+            this.rejectionReason = rejectionReason;
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlAlertData.java

@@ -30,6 +30,16 @@ import java.time.LocalDateTime;
  */
 public record AmlAlertData(Long id, String transactionType, Long transactionId, Long clientId, String clientDisplayName,
         String ruleCode, String ruleDescription, BigDecimal amount, String currencyCode, LocalDateTime raisedOn, String status,
-        String reviewedByUsername, LocalDateTime reviewedOn, String reviewNotes, String disposition, Integer riskCategory)
+        String reviewedByUsername, LocalDateTime reviewedOn, String reviewNotes, String disposition, Integer riskCategory,
+        /** Other rules the same transaction matched, comma-separated. Null when only one fired. */
+        String alsoMatchedRules,
+        /** Worst severity across every rule the transaction matched, not only the governing one. */
+        Integer highestSeverity,
+        /**
+         * Every rule the transaction matched, governing one first, each with its description and severity. The
+         * comma-separated {@code alsoMatchedRules} is kept for what already reads it; this is what the screen expands
+         * to show, because a bare rule code does not tell an officer what was detected or how serious it is.
+         */
+        java.util.List<AmlMatchedRuleData> matchedRules)
         implements Serializable {
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlCtrReportLineData.java

@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+
+/**
+ * One reportable line of a monthly CTR, carrying what the FIU-IND submission actually needs rather
+ * than only the ids the line is stored under.
+ *
+ * <p>
+ * The stored line keeps a client id and a transaction id; a filing needs the account, the customer,
+ * the branch and the date those ids stand for. They are joined here so the screen and the CSV are
+ * built from the report the bank generated, not from a second calculation that could disagree with
+ * it.
+ *
+ * <p>
+ * A connected-group line has no single transaction behind it - it is a month's worth of smaller
+ * cash movements by one customer that together cross the threshold - so its transaction id, account
+ * and date are null, and {@code connectedGroup} says why.
+ */
+public record AmlCtrReportLineData(Long id, Long reportId, String reportMonth, String transactionType, Long transactionId,
+        Long clientId, String clientName, String accountNo, String branchName, LocalDate transactionDate, String direction,
+        BigDecimal amount, boolean connectedGroup,
+        /**
+         * Account facts the Account_Detail file reports. They were being filled in with a constant
+         * opening date of 20/05/2018 and a status of ACTIVE for every row, which is a statement
+         * about the customer's account that nobody had checked.
+         */
+        LocalDate accountOpenedOn, LocalDate accountClosedOn, String accountStatus,
+        /** Customer identifiers the Account_Person_Relation file reports. */
+        String ckycNumber, String clientExternalId, boolean individual) implements Serializable {}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlDirection.java

@@ -0,0 +1,45 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+/**
+ * Which way the money moved, for rules written about one direction only.
+ *
+ * <p>
+ * Without this every rule was matched on amount alone, so a ₹12,00,000 deposit raised
+ * "Frequent low cash WITHDRAWAL" alongside the genuine CTR hit — nine of the ten alerts on that one
+ * transaction were of that kind, and an analyst reading them cannot tell which one is real.
+ */
+public enum AmlDirection {
+
+    /** Money into the customer's account: a deposit, or a loan disbursal. */
+    CREDIT,
+    /** Money out of it: a withdrawal, or a loan repayment. */
+    DEBIT,
+    /** Not established — the rule's own direction filter, if it has one, then does not apply. */
+    UNKNOWN;
+
+    public boolean isCredit() {
+        return this == CREDIT;
+    }
+
+    public boolean isDebit() {
+        return this == DEBIT;
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlMatchedRuleData.java

@@ -0,0 +1,43 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+import java.io.Serializable;
+
+/**
+ * One rule a transaction matched, as the alert screen needs to show it.
+ *
+ * <p>
+ * An alert names only the rule it was raised under; the rest were a comma-separated list of codes and nothing more. An
+ * officer deciding what to do with a transaction has to know what each of those codes means and how serious it is -
+ * "NEW_ACCOUNT_HIGH_VALUE_TXN" says nothing on its own, and whether it is Medium or High changes the decision.
+ *
+ * @param governing
+ *            whether this is the rule the alert was raised under. One transaction raises one alert, under whichever
+ *            rule most warrants attention, so exactly one entry in the list carries this.
+ * @param riskCategory
+ *            1 Low, 2 Medium, 3 High. Null for a rule with no catalog ancestor - the CTR rules are statutory returns
+ *            rather than graded suspicions, so they carry no band.
+ */
+public record AmlMatchedRuleData(String ruleCode, String ruleDescription, Integer riskCategory, boolean governing,
+        /** WHITELIST, ESCALATE, or null while this rule is still open. */
+        String disposition, String reviewedByUsername, String reviewNotes,
+        /** True where the officer named this rule; false where it was closed alongside one they named. */
+        boolean directlyDecided) implements Serializable {
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlSubjectScope.java

@@ -0,0 +1,64 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.aml.data;
+
+/**
+ * The kind of customer a rule is written about, for rules whose subject is the customer rather than
+ * the transaction.
+ *
+ * <p>
+ * Rules like "PEP account monitoring" and "charitable organisation cash withdrawal" name the entity
+ * in their own title, but nothing checked it: each was matched on amount alone and so fired on every
+ * ordinary customer who crossed the amount. Reporting every customer as a PEP is not the cautious
+ * reading - an analyst who sees a PEP alert on a salaried individual learns to ignore PEP alerts,
+ * and the one real politically exposed person is then missed among them.
+ */
+public enum AmlSubjectScope {
+
+    /** Politically exposed person, their relative or close associate. */
+    PEP,
+
+    /** Trust, society or other not-for-profit - cash withdrawals from these carry their own rule. */
+    CHARITABLE_ORG,
+
+    /**
+     * Dealers in precious metal and stones and the other businesses RBI names as higher risk,
+     * where a large transaction is worth reporting that would be routine for anyone else.
+     */
+    HIGH_RISK_BUSINESS,
+
+    /**
+     * A recently opened account. A large transaction through an account that has barely been used
+     * is the classic mule pattern; the same transaction on a decade-old account is not remarkable.
+     */
+    NEW_ACCOUNT;
+
+    public static AmlSubjectScope fromRule(final String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return AmlSubjectScope.valueOf(value.trim().toUpperCase());
+        } catch (final IllegalArgumentException e) {
+            // An unrecognised scope must not silently widen the rule back to everyone, so the
+            // caller treats null-from-blank and this case differently.
+            return null;
+        }
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/data/AmlTransactionContext.java

@@ -19,7 +19,9 @@
 package org.apache.fineract.portfolio.aml.data;
 
 import java.math.BigDecimal;
+import java.time.LocalDate;
 import java.time.LocalDateTime;
+import java.util.List;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
 import org.apache.fineract.portfolio.client.domain.Client;
 
@@ -45,9 +47,43 @@ public final class AmlTransactionContext {
      * rules are simply skipped for this context rather than guessed at.
      */
     private final BigDecimal windowAggregateAmount;
+    /**
+     * Which way the money moved. A rule written about withdrawals must not fire on a deposit, and
+     * "repayment of loan in cash" is not the same event as a disbursal.
+     */
+    private final AmlDirection direction;
+    /**
+     * How many qualifying transactions make up {@link #windowAggregateAmount}. Structuring is a
+     * pattern of MANY small transactions, so the count is what separates it from one large one:
+     * a single ₹12,00,000 deposit is a CTR, not structuring, however the window total reads.
+     */
+    private final int windowTransactionCount;
+    /**
+     * Every qualifying amount in the window, so a rule can count only what falls inside its own
+     * band. A single count cannot serve every rule: this client's window held four deposits — three
+     * small ones and one of ₹12,00,000 — which satisfied "three or more" for a structuring rule
+     * whose band none of the four sat in. Structuring is several transactions of a similar size,
+     * and only the amounts themselves can say whether that happened.
+     */
+    private final List<BigDecimal> windowAmounts;
+
+    /**
+     * When the account this transaction moved through was opened. The "large transaction on a new
+     * account" rule is about the account rather than the customer, and an old customer can open a
+     * new account. Null where the caller could not establish it, in which case the customer's own
+     * activation date stands in.
+     */
+    private final LocalDate subjectOpenedOn;
 
     public AmlTransactionContext(AmlTransactionType transactionType, Long transactionId, Client client, BigDecimal amount,
             String currencyCode, LocalDateTime occurredOn, boolean cash, BigDecimal windowAggregateAmount) {
+        this(transactionType, transactionId, client, amount, currencyCode, occurredOn, cash, windowAggregateAmount, AmlDirection.UNKNOWN,
+                0, List.of(), null);
+    }
+
+    public AmlTransactionContext(AmlTransactionType transactionType, Long transactionId, Client client, BigDecimal amount,
+            String currencyCode, LocalDateTime occurredOn, boolean cash, BigDecimal windowAggregateAmount, AmlDirection direction,
+            int windowTransactionCount, List<BigDecimal> windowAmounts, LocalDate subjectOpenedOn) {
         this.transactionType = transactionType;
         this.transactionId = transactionId;
         this.client = client;
@@ -56,6 +92,26 @@ public final class AmlTransactionContext {
         this.occurredOn = occurredOn;
         this.cash = cash;
         this.windowAggregateAmount = windowAggregateAmount;
+        this.direction = direction;
+        this.windowTransactionCount = windowTransactionCount;
+        this.windowAmounts = windowAmounts == null ? List.of() : List.copyOf(windowAmounts);
+        this.subjectOpenedOn = subjectOpenedOn;
+    }
+
+    public AmlDirection getDirection() {
+        return direction;
+    }
+
+    public int getWindowTransactionCount() {
+        return windowTransactionCount;
+    }
+
+    public List<BigDecimal> getWindowAmounts() {
+        return windowAmounts;
+    }
+
+    public LocalDate getSubjectOpenedOn() {
+        return subjectOpenedOn;
     }
 
     public AmlTransactionType getTransactionType() {

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/event/AmlDomainServiceImpl.java

@@ -30,6 +30,7 @@ import org.apache.fineract.infrastructure.event.business.domain.loan.transaction
 import org.apache.fineract.infrastructure.event.business.domain.savings.transaction.SavingsDepositBusinessEvent;
 import org.apache.fineract.infrastructure.event.business.domain.savings.transaction.SavingsWithdrawalBusinessEvent;
 import org.apache.fineract.infrastructure.event.business.service.BusinessEventNotifierService;
+import org.apache.fineract.portfolio.aml.data.AmlDirection;
 import org.apache.fineract.portfolio.aml.data.AmlTransactionContext;
 import org.apache.fineract.portfolio.aml.domain.AmlTransactionType;
 import org.apache.fineract.portfolio.aml.repository.AmlLoanTransactionQueryRepository;
@@ -113,12 +114,22 @@ public class AmlDomainServiceImpl implements AmlDomainService {
         }
         final LocalDate since = LocalDate.now().minusDays(STRUCTURING_WINDOW_DAYS);
         final List<SavingsAccountTransaction> recent = savingsQueryRepository.findForClientSince(client.getId(), since);
-        final BigDecimal windowAggregate = recent.stream().filter(t -> depositDirection ? t.isDeposit() : t.isWithdrawal())
+        // Same side of the ledger as the transaction being observed: a deposit is not part of a
-                .map(SavingsAccountTransaction::getAmount).reduce(BigDecimal.ZERO, BigDecimal::add);
+        // withdrawal pattern, so the two are aggregated separately.
+        final List<SavingsAccountTransaction> sameDirection = recent.stream()
+                .filter(t -> depositDirection ? t.isDeposit() : t.isWithdrawal()).toList();
+        // Each amount is carried through, not just the total: a rule has to be able to count what
+        // falls inside its own band. Three small deposits plus one of ₹12,00,000 satisfies "three or
+        // more" and a ₹10,00,000 total on the raw figures, which is how one large deposit came to be
+        // reported as structuring.
+        final List<BigDecimal> windowAmounts = sameDirection.stream().map(SavingsAccountTransaction::getAmount).toList();
+        final BigDecimal windowAggregate = windowAmounts.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
 
         final AmlTransactionContext context = new AmlTransactionContext(AmlTransactionType.SAVINGS, transaction.getId(), client,
                 transaction.getAmount(), transaction.getSavingsAccount().getCurrency().getCode(),
-                transaction.getDateOf().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate);
+                transaction.getDateOf().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate,
+                depositDirection ? AmlDirection.CREDIT : AmlDirection.DEBIT, sameDirection.size(), windowAmounts,
+                transaction.getSavingsAccount().getActivationDate());
         try {
             ruleEvaluationService.evaluate(context);
         } catch (final RuntimeException e) {
@@ -134,12 +145,18 @@ public class AmlDomainServiceImpl implements AmlDomainService {
         }
         final LocalDate since = LocalDate.now().minusDays(STRUCTURING_WINDOW_DAYS);
         final List<LoanTransaction> recent = loanQueryRepository.findForClientSince(client.getId(), since);
-        final BigDecimal windowAggregate = recent.stream().filter(LoanTransaction::isRepaymentLikeType)
+        final List<LoanTransaction> repayments = recent.stream().filter(LoanTransaction::isRepaymentLikeType).toList();
-                .map(t -> t.getAmount(transaction.getLoan().getCurrency()).getAmount()).reduce(BigDecimal.ZERO, BigDecimal::add);
+        final List<BigDecimal> windowAmounts = repayments.stream()
+                .map(t -> t.getAmount(transaction.getLoan().getCurrency()).getAmount()).toList();
+        final BigDecimal windowAggregate = windowAmounts.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
 
+        // A repayment takes money from the customer; a disbursal gives it to them. Rules such as
+        // "repayment of loan in cash" are about the first and must not fire on the second.
+        final AmlDirection direction = transaction.isRepaymentLikeType() ? AmlDirection.DEBIT : AmlDirection.CREDIT;
         final AmlTransactionContext context = new AmlTransactionContext(AmlTransactionType.LOAN, transaction.getId(), client,
                 transaction.getAmount(transaction.getLoan().getCurrency()).getAmount(), transaction.getLoan().getCurrency().getCode(),
-                transaction.getTransactionDate().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate);
+                transaction.getTransactionDate().atStartOfDay(), isCash(transaction.getPaymentDetail()), windowAggregate, direction,
+                repayments.size(), windowAmounts, transaction.getLoan().getApprovedOnDate());
         try {
             ruleEvaluationService.evaluate(context);
         } catch (final RuntimeException e) {

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlAlertReadPlatformServiceImpl.java

@@ -18,15 +18,25 @@
  */
 package org.apache.fineract.portfolio.aml.service;
 
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import lombok.RequiredArgsConstructor;
 import org.apache.fineract.portfolio.aml.data.AmlAlertData;
+import org.apache.fineract.portfolio.aml.data.AmlMatchedRuleData;
 import org.apache.fineract.portfolio.aml.domain.AmlAlert;
 import org.apache.fineract.portfolio.aml.domain.AmlAlertRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRule;
+import org.apache.fineract.portfolio.aml.domain.AmlAlertRuleRepository;
+import org.apache.fineract.portfolio.aml.domain.AmlTransactionRule;
+import org.apache.fineract.portfolio.aml.domain.AmlTransactionRuleRepository;
 import org.apache.fineract.portfolio.client.domain.ClientRiskRuleRepository;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -38,22 +48,127 @@ public class AmlAlertReadPlatformServiceImpl implements AmlAlertReadPlatformServ
 
     private final AmlAlertRepository repository;
     private final ClientRiskRuleRepository clientRiskRuleRepository;
+    private final AmlAlertRuleRepository alertRuleRepository;
+    private final AmlTransactionRuleRepository transactionRuleRepository;
 
     @Override
     public List<AmlAlertData> retrieve(String statusFilter) {
         final List<AmlAlert> alerts = (statusFilter == null || statusFilter.isBlank()) ? repository.findAll()
                 : repository.findByStatusOrderByRaisedOnAsc(statusFilter);
+        // Nothing flagged is an ordinary state - a quiet period, or a bank that has just been set up - and every
+        // lookup below reads a list built from these alerts. An empty IN clause is a syntax error in Postgres, so
+        // without this the screen fails outright at the very moment it has nothing to report.
+        if (alerts.isEmpty()) {
+            return List.of();
+        }
         // Resolved once for the whole page rather than per alert: many alerts share a rule, so a
         // lookup inside the map step would re-read the same catalog rows repeatedly.
-        final Map<Long, Integer> riskByRiskRuleId = riskCategoriesFor(alerts);
+        // Same reasoning for the also-matched rules, which are held on the alert as bare codes: one
+        // read for every code on the page, not one per alert.
+        // The findings beneath each alert - one row per rule, carrying that rule's own disposition. Read for the whole
+        // page at once rather than per alert.
+        final Map<Long, List<AmlAlertRule>> findingsByAlertId = this.alertRuleRepository
+                .findByAlertIdIn(alerts.stream().map(AmlAlert::getId).toList()).stream()
+                .collect(Collectors.groupingBy(f -> f.getAlert().getId()));
+        final Map<String, AmlTransactionRule> rulesByCode = rulesByCodeFor(alerts, findingsByAlertId);
+        final Map<Long, Integer> riskByRiskRuleId = riskCategoriesFor(alerts, rulesByCode.values());
         return alerts.stream().sorted(Comparator.comparing(AmlAlert::getRaisedOn).reversed())
-                .map(alert -> mapToData(alert, riskByRiskRuleId)).collect(Collectors.toList());
+                .map(alert -> mapToData(alert, riskByRiskRuleId, rulesByCode, findingsByAlertId)).collect(Collectors.toList());
     }
 
-    /** Severity of each originating catalog rule, keyed on m_client_risk_rule.id. */
+    /**
-    private Map<Long, Integer> riskCategoriesFor(final List<AmlAlert> alerts) {
+     * Every rule named anywhere on this page, keyed on its code.
-        final List<Long> sourceIds = alerts.stream().map(a -> a.getRule().getSourceClientRiskRuleId()).filter(id -> id != null).distinct()
+     *
-                .toList();
+     * <p>
+     * Covers the findings as well as the also-matched lists, because a finding holds only a code and the pane needs the
+     * description behind it.
+     */
+    private Map<String, AmlTransactionRule> rulesByCodeFor(final List<AmlAlert> alerts,
+            final Map<Long, List<AmlAlertRule>> findingsByAlertId) {
+        final Set<String> codes = alerts.stream().map(AmlAlert::getAlsoMatchedRules).filter(s -> s != null && !s.isBlank())
+                .flatMap(s -> Arrays.stream(s.split(","))).map(String::trim).filter(s -> !s.isEmpty())
+                .collect(Collectors.toCollection(java.util.HashSet::new));
+        findingsByAlertId.values().stream().flatMap(List::stream).map(AmlAlertRule::getRuleCode).forEach(codes::add);
+        alerts.stream().map(a -> a.getRule().getRuleCode()).forEach(codes::add);
+        if (codes.isEmpty()) {
+            return Map.of();
+        }
+        final Map<String, AmlTransactionRule> byCode = new HashMap<>();
+        this.transactionRuleRepository.findByRuleCodeIn(codes).forEach(rule -> byCode.put(rule.getRuleCode(), rule));
+        return byCode;
+    }
+
+    /**
+     * Every rule the transaction matched, governing one first, each carrying its description and severity.
+     *
+     * <p>
+     * A rule whose catalog ancestor is missing still appears, with a null severity rather than being dropped: the
+     * officer needs to see that it fired. A code with no rule behind it at all - a rule deleted since the alert was
+     * raised - keeps its code as the description, because the alert is a record of what happened and editing the rule
+     * set afterwards does not change that.
+     */
+    private List<AmlMatchedRuleData> matchedRulesOf(final AmlAlert alert, final Map<Long, Integer> riskByRiskRuleId,
+            final Map<String, AmlTransactionRule> rulesByCode, final Map<Long, List<AmlAlertRule>> findingsByAlertId) {
+        final List<AmlAlertRule> findings = findingsByAlertId.get(alert.getId());
+        if (findings != null && !findings.isEmpty()) {
+            // Governing rule first, then by code, so the pane does not reorder itself between reads.
+            return findings.stream()
+                    .sorted(Comparator.comparing(AmlAlertRule::isGoverning).reversed().thenComparing(AmlAlertRule::getRuleCode))
+                    .map(f -> new AmlMatchedRuleData(f.getRuleCode(), describe(f.getRuleCode(), rulesByCode), f.getRiskCategory(),
+                            f.isGoverning(), f.getDisposition(),
+                            f.getReviewedBy() == null ? null : f.getReviewedBy().getUsername(), f.getReviewNotes(),
+                            f.isDirectlyDecided()))
+                    .collect(Collectors.toList());
+        }
+
+        // No findings rows: an alert raised before they existed and not covered by the backfill. Rebuilt from the flat
+        // fields so the pane still shows what fired, with no per-rule disposition to report.
+        final List<AmlMatchedRuleData> matched = new ArrayList<>();
+        final Long governingSourceId = alert.getRule().getSourceClientRiskRuleId();
+        matched.add(new AmlMatchedRuleData(alert.getRule().getRuleCode(), alert.getRule().getDescription(),
+                governingSourceId == null ? null : riskByRiskRuleId.get(governingSourceId), true, null, null, null, false));
+
+        final String also = alert.getAlsoMatchedRules();
+        if (also == null || also.isBlank()) {
+            return matched;
+        }
+        for (final String raw : also.split(",")) {
+            final String code = raw.trim();
+            if (code.isEmpty()) {
+                continue;
+            }
+            final AmlTransactionRule rule = rulesByCode.get(code);
+            final Long sourceId = rule == null ? null : rule.getSourceClientRiskRuleId();
+            matched.add(new AmlMatchedRuleData(code, describe(code, rulesByCode),
+                    sourceId == null ? null : riskByRiskRuleId.get(sourceId), false, null, null, null, false));
+        }
+        return matched;
+    }
+
+    /**
+     * A rule's description, or its code when the rule itself is gone.
+     *
+     * <p>
+     * An alert records what was detected at the time; a rule retired since then does not erase the finding, so the code
+     * stands in rather than the row disappearing.
+     */
+    private String describe(final String ruleCode, final Map<String, AmlTransactionRule> rulesByCode) {
+        final AmlTransactionRule rule = rulesByCode.get(ruleCode);
+        return rule == null || rule.getDescription() == null ? ruleCode : rule.getDescription();
+    }
+
+    /**
+     * Severity of each originating catalog rule, keyed on m_client_risk_rule.id.
+     *
+     * <p>
+     * Covers the also-matched rules as well as the governing ones. Resolving only the governing rules left every
+     * also-matched rule reporting a null severity, which is exactly the thing the expanded row exists to show.
+     */
+    private Map<Long, Integer> riskCategoriesFor(final List<AmlAlert> alerts, final Collection<AmlTransactionRule> alsoMatched) {
+        final List<Long> sourceIds = Stream
+                .concat(alerts.stream().map(a -> a.getRule().getSourceClientRiskRuleId()),
+                        alsoMatched.stream().map(AmlTransactionRule::getSourceClientRiskRuleId))
+                .filter(id -> id != null).distinct().toList();
         final Map<Long, Integer> byId = new HashMap<>();
         if (sourceIds.isEmpty()) {
             return byId;
@@ -62,13 +177,15 @@ public class AmlAlertReadPlatformServiceImpl implements AmlAlertReadPlatformServ
         return byId;
     }
 
-    private AmlAlertData mapToData(AmlAlert alert, Map<Long, Integer> riskByRiskRuleId) {
+    private AmlAlertData mapToData(AmlAlert alert, Map<Long, Integer> riskByRiskRuleId, Map<String, AmlTransactionRule> rulesByCode,
+            Map<Long, List<AmlAlertRule>> findingsByAlertId) {
         final Long sourceRiskRuleId = alert.getRule().getSourceClientRiskRuleId();
         final Integer riskCategory = sourceRiskRuleId == null ? null : riskByRiskRuleId.get(sourceRiskRuleId);
         return new AmlAlertData(alert.getId(), alert.getTransactionType().name(), alert.getTransactionId(), alert.getClient().getId(),
                 alert.getClient().getDisplayName(), alert.getRule().getRuleCode(), alert.getRule().getDescription(), alert.getAmount(),
                 alert.getCurrencyCode(), alert.getRaisedOn(), alert.getStatus().name(),
                 alert.getReviewedBy() == null ? null : alert.getReviewedBy().getUsername(), alert.getReviewedOn(),
-                alert.getReviewNotes(), alert.getDisposition() == null ? null : alert.getDisposition().name(), riskCategory);
+                alert.getReviewNotes(), alert.getDisposition() == null ? null : alert.getDisposition().name(), riskCategory,
+                alert.getAlsoMatchedRules(), alert.getHighestSeverity(), matchedRulesOf(alert, riskByRiskRuleId, rulesByCode, findingsByAlertId));
     }
 }

fineract-provider/src/main/java/org/apache/fineract/portfolio/aml/service/AmlAlertWritePlatformService.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.portfolio.aml.service;
 
+import java.util.List;
 import org.apache.fineract.portfolio.aml.domain.AmlAlert;
 import org.apache.fineract.portfolio.aml.domain.AmlStrCase;
 
@@ -27,4 +28,29 @@ public interface AmlAlertWritePlatformService {
     AmlAlert whitelist(Long alertId, String notes);
 
     AmlStrCase escalate(Long alertId, String notes);
+
+    /**
+     * Escalates several alerts into a single STR case.
+     *
+     * <p>
+     * For a case raised off a customer's repeated behaviour rather than one transaction. Escalating each alert
+     * separately would put one case per transaction in front of the Principal Officer, each holding a fragment of a
+     * pattern that only means anything taken together - and a customer reviewed again a month later would add several
+     * more. An STR to FIU-IND reports the activity, so the case has to hold all of it.
+     *
+     * @param alertIds
+     *            the alerts the pattern is made of; any already covered by a case keep that case
+     * @return the case covering them, or null when every alert was already covered
+     */
+    AmlStrCase escalateAsOneCase(List<Long> alertIds, String notes);
+
+    /**
+     * Decides individual rules within one alert, leaving the rest open.
+     *
+     * @param ruleCodes
+     *            the rules being decided now
+     * @param disposition
+     *            WHITELIST or ESCALATE, applied to each of them
+     */
+    AmlAlert reviewRules(Long alertId, List<String> ruleCodes, String disposition, String notes);
 }