Remove human glue from your financial stack.
Haia connects business intent, policy, execution and records into one operational state — so complex money movement no longer depends on people stitching the picture together.
Haia turns that operating intelligence into infrastructure.
Regulators are converging on end-to-end operational resilience.
Across major financial jurisdictions, regulated institutions are increasingly expected to understand critical services and operations end to end — including the systems and third parties that support them.
- [ 01 ]
Identify critical operations
Know which business services and operations must continue.
- [ 02 ]
Map end to end
Understand the people, processes, technology, data and systems that jointly deliver them.
- [ 03 ]
Own third-party dependencies
Using a provider does not automatically transfer the regulated institution's accountability.
- [ 04 ]
Test delivery within tolerance
Determine whether the operation or service can still be delivered through severe disruption.
Basel Committee - Principles for Operational Resilience / ORR20
- CRITICAL OPERATIONS
- END-TO-END DEPENDENCY MAPPING
- THIRD-PARTY DEPENDENCIES
Banks should identify critical operations and map the people, technology, processes, information, facilities and internal/external interdependencies needed to deliver them, including third-party dependencies.
Scope International supervisory principles for banks; not a universal global statute.
Primary sourceFederal Reserve / OCC / FDIC - Sound Practices to Strengthen Operational Resilience
- CRITICAL OPERATIONS
- CORE BUSINESS LINES
- INTERDEPENDENCIES + THIRD PARTIES
The interagency paper brings together existing expectations around critical operations, core business lines, tolerance for disruption, interconnections and significant third-party dependencies.
Scope Directed to the largest and most complex domestic banking organizations; the paper itself does not create new regulation or guidance.
Primary sourceDORA - Regulation (EU) 2022/2554
- CRITICAL OR IMPORTANT FUNCTIONS
- ICT DEPENDENCIES
- ENTITY REMAINS RESPONSIBLE
DORA requires in-scope financial entities to manage ICT risk and third-party dependencies around critical or important functions and maintain responsibility for their own regulatory obligations.
Scope Applies to the financial entities defined in DORA; do not generalize it to every EU business.
Primary sourceFCA Operational Resilience / SYSC 15A
- IMPORTANT BUSINESS SERVICES
- IMPACT TOLERANCES
- RESOURCE + THIRD-PARTY MAPPING
Firms in scope must identify important business services, set impact tolerances and map the people, processes, technology, facilities, information and relevant third parties needed to deliver them.
Scope Applies to firms within the FCA operational-resilience scope; scope is not universal across all UK companies.
Primary sourceMAS Guidelines on Business Continuity Management
- CRITICAL BUSINESS SERVICES
- DEPENDENCY MAPPING
- THIRD-PARTY RESILIENCE
MAS guidance frames resilience around critical business services and dependency mapping across the functions, processes and resources that support them, including relevant third parties.
Scope Supervisory guidance for financial institutions; not a general statutory requirement for all Singapore companies.
Primary sourceHKMA Supervisory Policy Manual OR-2 - Operational Resilience
- CRITICAL OPERATIONS
- INTERCONNECTIONS + DEPENDENCIES
- THIRD-PARTY DEPENDENCY MANAGEMENT
Authorized Institutions are expected to identify critical operations, understand underlying interconnections and dependencies, and maintain resilience through business-continuity and third-party dependency management.
Scope HKMA supervisory guidance for Authorized Institutions.
Primary sourceAPRA CPS 230 - Operational Risk Management
- CRITICAL OPERATIONS
- TOLERANCE LEVELS
- SERVICE PROVIDER RISK
APRA-regulated entities must manage operational risk, maintain critical operations within tolerance levels through severe disruptions, and manage risks arising from service providers.
Scope Current CPS 230 is in force from 1 July 2026 for the APRA-regulated entities defined by the standard.
Primary sourceOSFI Guideline E-21 - Operational Risk Management and Resilience
- END-TO-END CRITICAL OPERATIONS
- INTERNAL + EXTERNAL DEPENDENCIES
- TOLERANCE + SCENARIO TESTING
OSFI states that operational resilience requires an end-to-end view of critical operations and mapping of people, technology, processes, information, facilities, third parties and the dependencies among them.
Scope Applies to the federally regulated financial institutions listed in Guideline E-21, on a risk-based and proportionate basis.
Primary sourceFINMA Circular 2023/1 - Operational risks and resilience
- CRITICAL FUNCTIONS
- DEPENDENCIES
- TOLERANCE + TESTING
Institutions must identify critical functions and tolerances for disruption, maintain an inventory of connections and dependencies between critical processes and resources, and test delivery within tolerance under severe but plausible scenarios.
Scope Applies within the scope defined by FINMA Circular 2023/1; do not generalize beyond covered supervised institutions.
Primary sourceCBUAE Operational Risk Management Regulation C 1/2026
- CRITICAL OPERATIONS
- OPERATIONAL RESILIENCE
- THIRD-PARTY DEPENDENCIES
Licensed Financial Institutions must identify and manage risks to Critical Operations and integrate third-party arrangements affecting Critical Operations into their operational-resilience and operational-risk frameworks.
Scope C 1/2026 is in force from 14 September 2026 and applies to Licensed Financial Institutions within the CBUAE Rulebook scope.
Primary sourceYour regulatory architecture is already moving end to end. Your operating software probably isn't.
Local systems establish authoritative facts. Regulators increasingly expect institutions to understand the critical service or operation those systems collectively support.
Every system can be right.
The operation can still be open.
Because local systems prove their piece. Your business is accountable for the outcome.
System states are evidence. The business operation is the unit of control.
One business outcome. Multiple locally authoritative systems.
Local systems keep their authority. Haia keeps the complete operation together across them.
The state matters when it changes what happens next.
Haia turns fragmented state into an owned, evidenced and bounded next action — including prerequisites, constraints and the authority required to proceed.
Control does not mean bypassing authority.
Policy evaluation · identity and access · approvals · audit trail · evidence.
Keep the operation visible, owned and moving.
- [ 01 ] See
Know the state of the complete operation.
See events and evidence in the context of the business outcome they belong to.
- [ 02 ] Control
Keep intent, rules and execution connected.
Carry ownership, policy and expected outcome alongside the movement of money.
- [ 03 ] Resolve
Turn open states into owned next actions.
Make unresolved work visible and move the operation toward completion.
- [ 04 ] Improve
Make every operation inform the next.
Turn outcomes and exceptions into better future decisions.
More programmable rails mean more operational coordination.
Banks, wallets, stablecoin rails, payment providers, ledgers and internal systems each remain authoritative for their piece. The enterprise still has to keep the complete operation together across them.
Haia gives the business a control plane across them.
One operating layer across the financial stack.
Keep every specialist system doing what it does best. Haia connects the operation across them.
- Owner
- Obligation
- Outcome
- Authority
- Approval
- Limits
- Bank
- Wallet
- Provider
- Ledger
- Evidence
- Reconciliation
Start with one consequential operation. Expand where the same control pattern repeats.
Treasury / liquidity / settlement remains the primary validation lane. The same control pattern can extend to enterprise payout completion and platform funding / withdrawal / multi-party payout operations.
Start with the operation your team keeps reconstructing manually.
Bring us one operation your team still has to reconstruct manually. We’ll show you what changes when the whole operation can be seen and managed as one.