Every regulatory decision your organisation makes — VaR calculations, liquidity checks, credit assessments — leaves a trail. Today that trail is email chains, PDFs, and shared drives. OpenChainGraph replaces it with something a regulator can verify in their own browser in seconds, with no document requests and no version confusion. This page shows exactly what changes, and what doesn't, across three real scenarios.
OpenChainGraph is built on one idea borrowed from cryptography: a hash function. Feed any document, number, or decision into a hash function and it produces a unique 64-character string — a digital fingerprint. The critical property: change anything about the input, even a single digit, and the entire fingerprint changes beyond recognition. There is no such thing as a "close" fingerprint — two inputs are either identical or completely different.
In the legacy world, one person sends another person a spreadsheet. There is no way to prove the spreadsheet hasn't been modified, or that it's the same version used for a different calculation. With OpenChainGraph, every decision tool stamps its inputs and outputs with a fingerprint before publishing. Any downstream tool, regulator, or auditor can independently recompute the fingerprint and confirm it matches — in seconds, in their own browser, with no access to your systems.
The Internal Capital Adequacy Assessment Process (ICAAP) is one of banking's most intensive annual regulatory exercises. It requires proving that five or more interdependent calculations — risk, stress, liquidity, credit, capital — are consistent, current, and tamper-free. Today, that proof is a 142-page PDF assembled from seven separate email attachments.
VaR_FXDESK_Q4_FINAL_v3.xlsx. No version control. The file name is the only record of which version this is.A high-value payment is flagged as fraudulent three months after authorisation. The card scheme requests proof that your fraud scoring system flagged it correctly at the moment the payment was released. In the legacy world, you can retrieve the log entry — but you cannot prove that the log reflects the exact model and inputs active at that instant.
A log entry can be altered. A spreadsheet can be edited and re-saved. A system can be updated and backdated. All of these are reconstructions — human-assembled chains of assertion. A SHA-256 fingerprint is different in kind: it is a mathematical function of the exact byte sequence of the data at the moment it was computed. You cannot produce the same fingerprint from different data. You cannot alter the data and keep the fingerprint. Independent parties can verify it themselves. That's the difference between an assertion and a proof.
A letter of credit covers a €4.2M shipment of semiconductor equipment. Compliance requires AML screening, sanctions checks, and document verification — and a regulator must be able to prove, 18 months later, that all three were completed before the payment was released. Today, those checks live in three separate systems with no cryptographic link to the payment instruction.
These figures represent the aggregated difference across ICAAP, fraud, and trade finance workflows — the three scenarios above, combined. Figures are illustrative, based on representative legacy audit patterns; outcomes vary by institution and jurisdiction.
The change is not in how decisions are made — it's in how they're recorded and proved. Here is the concrete change for each role.
OpenChainGraph is a standard for recording and linking decision outputs — not a replacement for the decisions themselves, the models that produce them, or the people who make them.
This page tells the story at the business level. The technical explainer walks through how the fingerprinting actually works — the same SHA-256 function, step by step, in seven animated stages. The live sandbox lets you edit a real artifact and watch the fingerprint break in your browser. No setup, no account, no server.