Scope & reliance — 🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only. Embedded rates, thresholds, and regulatory citations are static reference values that may age — verify against current primary sources and your own data before relying on any output for commercial, legal, or compliance decisions. Deterministic logic · no inference · zero PII · CC BY 4.0.

Educational Use Only This tool provides a self-assessment / educational framework for internal planning purposes only. It is not a regulatory audit, legal advice, or a substitute for a formal compliance review by a qualified advisor. Verify all interpretations against the official source text and applicable RTS/ITS/guidance published by the relevant authority.

Tool 03 · Consent & Compliance

Consent Simulator + Compliance Auditor

Prototype OAuth 2.0/PKCE consent flows and audit against PSD2, CFPB 1033, and GDPR requirements. Visualise token lifecycles and generate compliance receipts. Client-side only.

PSD2 · CFPB 1033 · GDPR OAuth 2.0 / PKCE v1.0

Configure Consent Rule-Based Engine

Application

App / Client Name

Redirect URI

Regulatory Regime

Data Scopes

account_info Account number, institution, account type, status

Low

balances Available balance, ledger balance, overdraft limit

Low

transactions Transaction history, amounts, merchant details, dates

Medium

payment_initiation Ability to initiate transfers on behalf of user

High

identity Name, address, date of birth, national ID fragments

High

Consent Parameters

Duration (days)

Renewal Required

90-day consent is within CFPB 1033 guidelines. Renewal mechanism recommended for durations exceeding 90 days.

⚖️

No audit run yet

Configure scopes and click "Run Compliance Audit" to generate a scorecard

🔑

No token generated

Run the audit to generate a mock JWT access token

🧪

No scopes granted yet

Run the audit to explore mock API responses for each granted scope

📄

No consent receipt

Run the audit to generate a plain-English consent receipt

What this tool does

Tool 03 in the AINumbers.co A2A Fintech Suite simulates OAuth 2.0 Authorization Code + PKCE consent flows and audits your selected data scopes against three regulatory frameworks: CFPB Open Banking Rule 1033 (US), PSD2 + GDPR (EU), and UK Open Banking / VRP (UK). It outputs a color-coded compliance scorecard, targeted remediation steps, a mock JWT, mock API JSON responses, and a plain-English consent receipt.

How the rule engine works

All logic is transparent JavaScript conditionals: no black-box ML, no external endpoints. Key rules include:

payment_initiation + transactions → elevated scrutiny across all regimes
duration > 90 days without explicit renewal → CFPB 1033 warning
identity scope → GDPR lawful basis documentation required (EU)
payment_initiation without strong authentication flag → PSD2 SCA warning
identity + payment_initiation → highest risk combination, full AML/KYC note
auto-renewal without user notification → warning in all regimes

Limitations

This is a prototyping and education tool. The mock JWT is not cryptographically signed and cannot be used in production. Compliance findings are illustrative; engage qualified legal counsel for actual regulatory requirements.