§ 00Contents

Document conventions

Findings are numbered F-NN; recommendations R-NN; gap-filler entries GF-NN. Severity classifications (HIGH / MEDIUM / LOW) refer to the impact on AI integration readiness, not to general operational risk.

The Draft PRISM in Appendix A is rendered in structured Markdown, which is the canonical format used in the Moschetti Consulting methodology. The format is human-readable and machine-readable; downstream tooling derives implementation, tests, monitoring, and audit evidence from this single source.

§ 01Executive summary

Northway's private client onboarding process functions, but it functions on a foundation of human accommodations that would not survive the AI-assisted automation contemplated in the Q2 2026 platform program. The two-week assessment identified twelve findings across the process, of which four are classified HIGH severity for AI-integration readiness. A draft PRISM has been produced for the assessed process and is included as Appendix A.

Headline observations

Bottom line

The Q2 platform program, as currently scoped, is likely to deliver a faster process that produces more inconsistent outcomes than the current process — because the AI-assisted steps will operate on the documented process, not the observed one. The shortest path to a successful integration is not to rescope the platform program. It is to produce, in advance of the integration, the specification artifact described in Appendix A — fully closed and simulated — and to use that artifact as the input to the platform team rather than the current documentation. We estimate this work, fully scoped, at 8 — 10 weeks.

What follows

§ 02 describes the scope and method of this two-week engagement. § 03 reconstructs the process as actually observed, contrasted with the documented version. § 04 enumerates the twelve findings. § 05 inventories the gap-filler dependencies. § 06 assesses the integration risk against the Q2 program scope. § 07 presents seven prioritized recommendations. Appendix A contains the draft PRISM excerpt; Appendix B documents interviewees and sources.

§ 02Engagement scope and method

In scope

The private client onboarding process within the Wealth Management Division of Northway Financial Group, US domicile, from receipt of the prospect's application through funded-account status and assignment of an active relationship manager. Both individual and joint account types are included. Trust and entity-account onboarding are excluded, as are corporate banking and institutional flows.

Out of scope

Vendor and counterparty onboarding; AML and KYC source-system implementation (assessed as upstream dependencies but not redesigned); the prospect-acquisition pipeline preceding application receipt; ongoing servicing post-funding.

Method

Limitations

The two-week engagement window is sufficient to identify the structural patterns documented in this report and to produce a credible draft PRISM, but it is not sufficient to fully close the specification under the methodology's adversarial-interrogation discipline. Recommendation R-01 addresses this scope explicitly. We did not interview Northway's external KYC vendor; representations about the vendor interface are based on Northway operator accounts and the vendor portal's behavior, not on direct vendor consultation.

Confidentiality and use

This document contains observations about Northway's internal processes and named individuals' roles. It is provided under the terms of the engagement letter dated 10 March 2026. Distribution beyond the named recipients listed on the cover requires written agreement.

§ 03The process as observed

The diagrams below contrast the process as documented in Northway's current onboarding playbook (Fig. 1) with the process as we observed it in the 40-case sample (Fig. 2). The contrast is the substantive finding of this section; the individual deviations are catalogued in § 04.

The headline observation is that no observed case in our 40-case sample completed using only the steps in Fig. 1. The closest case used 19 of the 27 transitions; the typical case used 22 — 25. The unaccounted-for steps are not exceptions in any meaningful sense; they are the work.

Time-in-process distribution

The 40-case sample showed a median onboarding duration of 11 calendar days against a stated target of 5 business days. The variance is dominated by re-entry into earlier stages, not by elapsed time within any single stage. The table below summarizes elapsed time per documented stage versus per observed sub-flow.

Authoritative sources for "approved"

During interviews, four distinct definitions of approved client emerged across the operating teams. None of these definitions are wrong in the team's local context. They are nevertheless not the same definition, and the present process operates because human operators translate between them in real time. We document them explicitly here because Findings F-03, F-07, and F-09 turn on this point.

§ 04Findings

Findings are presented in declining order of severity for AI-integration readiness. Severity classifications refer to the impact on the Q2 platform program, not to operational risk in the current process. Each finding is structured: identifier, title, severity, domain, and observation / impact / recommendation reference.

Detailed findings — High severity

Detailed findings — Medium severity (summarized)

Findings F-05 through F-09 are detailed in the supplementary findings appendix delivered alongside this report (omitted here for brevity). Each follows the same structure as F-01 through F-04 above.

Detailed findings — Low severity (summarized)

Findings F-10 through F-12 are documented at one paragraph each in the supplementary appendix. None block the Q2 program but each warrants attention in subsequent specification iteration.

§ 05Gap-filler inventory

"Gap-fillers" are the human accommodations that enable the current process to function despite documentation gaps. Each entry below identifies a specific accommodation, the operator(s) performing it, the failure that would result if the accommodation ceased, and the residual concentration risk if the operator left the role.

Concentration analysis

Of 17 identified gap-fillers, 6 are classified High concentration risk. Of these 6, four involve Sue M. either solely or as the principal operator. The remaining two concentrate in the same KYC operations sub-team. The Q2 program timeline overlaps Sue M.'s stated retirement window. Recommendation R-03 addresses this.

§ 06AI integration risk assessment

This section assesses the integration risks specific to the Q2 2026 onboarding platform program (project code WM-OPS-401) as currently scoped per the program PRD rev. 0.4 dated 18 February 2026. Scope statements in the PRD have been mapped against the findings and gap-fillers above. Risks are characterized by likelihood (in the AI-deployed configuration) and consequence.

Aggregated assessment

The Q2 program in its current form is, in our judgment, likely to deliver against its throughput and cost-reduction objectives while introducing a class of consistency and audit risks that will require remediation in flight. The program's risk profile is meaningfully improved if the recommendations in § 07 are completed before the platform's compliance-approval and false-positive-triage components reach production.

We do not recommend cancelling the program. We recommend separating the high-confidence components (document re-keying, document-format normalization, vendor-data ingestion — gap-fillers GF-01, GF-13, GF-14) from the components that depend on contested semantics (compliance approval, false-positive triage, free-text instruction handling — gap-fillers GF-02 — GF-04, GF-06, GF-12, GF-15). The first set can proceed against the current documentation. The second set requires the PRISM work described in R-01.

Component-level readiness

The matrix below maps the Q2 program's nine workflow components to the readiness state observed in this audit. A component is rated "Ready" if its documented behavior matches its observed behavior closely enough to be a defensible AI training and validation target. "Conditional" components require specific PRISM work before being integration-ready. "Not ready" components require substantive process redesign before any AI involvement is appropriate.

Two components are Ready as scoped. Two are Not Ready. Five are Conditional, awaiting specification work for which the draft PRISM is the foundation. The Ready components alone account for approximately 35% of the projected program benefit per the Q2 PRD's value model. We believe a phased deployment that ships the Ready components to production while the PRISM work proceeds against the Conditional and Not Ready components is achievable inside the program's stated timeline.

This phasing is the substantive recommendation embedded in R-07.

§ 07Recommendations

Recommendations are ordered by priority. Each recommendation identifies the findings it addresses, the proposed effort, and a timing window relative to the Q2 platform program's stated milestones. P0 recommendations are those we believe must be completed before the Q2 program advances to its build phase; P1 recommendations are required before production deployment of the affected components; P2 recommendations are advisable within 6 months of deployment.

§ 08Closing

This report represents the product of two weeks of focused engagement with Northway Financial Group's Wealth Management onboarding operations. We are grateful for the time and candor of the eleven individuals who participated in interviews, and for the access and document support provided by the Wealth Management Operations leadership.

The findings above are unflattering only in the specific sense that they describe a process running on accommodations its documentation does not capture. This is, in our experience, the universal state of mature business processes prior to formal specification work. The presence of seventeen gap-fillers in this process is not evidence of operational deficiency; it is evidence that competent humans have been quietly doing the work the documentation did not specify, for a number of years, with skill and judgment. The purpose of this report is not to fault that work. It is to make the work visible — so that the next generation of automation has the chance to inherit the substance of the accommodations, not merely the documented surface.

The recommendation set above is, we believe, achievable within the existing program timeline given a focused 8 — 10 week specification effort. We are available to discuss the recommendations in detail at the convenience of the Northway team, and to scope any subsequent engagement against the Conditional and Not Ready components identified in § 06.

App. ADraft PRISM (excerpt)

The following is an excerpt from the draft PRISM for Northway Private Client Onboarding, in the state at engagement end. The full draft (~46 pages) is delivered as a separate Markdown document. The excerpt reproduced here demonstrates the format and the level of definitional rigor characteristic of a specification ready to be input to AI-assisted implementation. Note in particular the explicit disambiguation of "approved" across artifact attributes (per R-02), and the explicit specification of one exception class (per R-04).

---
spec_id: nfg-private-client-onboarding
version: 0.4 (engagement end · pre-closure)
owner: head-of-wm-operations
scope: us-domiciled individual and joint accounts; trust and entity excluded
closure_status: incomplete; ~62% of dimensions resolved
---

# Private Client Onboarding

## Purpose

To onboard a private wealth client from application receipt
through funded-account state with a complete authorization and
audit record sufficient to satisfy the firm's regulatory
attestations and the client's expectations regarding speed
and accuracy.

## Roles

- `applicant` — natural person; subject of the onboarding case.
- `relationship_manager` — named role; one per case after assignment.
- `kyc_operator` — named role; one per business unit.
- `compliance_lead` — named role; enterprise-wide. # incumbent: see R-03
- `account_ops_specialist` — named role; one per paying entity.
- `treasury_liaison` — named role; one per region.

## Artifacts

### case

The onboarding case record. Created on application receipt;
terminates on funded state or rejection.

Required attributes:
- `id` — immutable, system-assigned.
- `kyc_clearance_state` — one of:
    `pending`, `vendor_returned`, `cleared`, `cleared_with_notes`,
    `false_positive_resolved`, `held_for_review`, `rejected`.
- `compliance_approval_state` — one of:
    `not_required`, `pending`, `approved`, `held`, `denied`.
    # PER R-02: this is one of four formerly-conflated
    # meanings of "approved." See also account_opening_state.
- `account_opening_state` — one of:
    `not_yet_initiated`, `initiated`, `documents_pending`,
    `opened_inactive`, `opened_active`, `void`.
- `front_office_funded_state` — one of:
    `not_yet_funded`, `wire_pending`, `funded`, `holdback_applied`.

## Exception class · KYC adverse-media false positive

# PER R-04 / F-04: prior to this specification, the resolution path
# for this exception class was not canonical; three observed paths.
# This section pins down the canonical path.

### Detection

KYC vendor return contains an adverse-media match for which
the `kyc_operator` judges, on inspection, that the matched
record refers to an entity other than the `applicant`.

### Resolution path

1. `kyc_operator` records the false-positive judgment in
   structured field `case.kyc_fp_judgment`, with required
   reason code from enumerated set
   `{name_collision, dob_mismatch, jurisdiction_mismatch, other}`.
2. `compliance_lead` reviews the recorded judgment.
   - If accepted: `case.kyc_clearance_state ← false_positive_resolved`.
   - If rejected: `case.kyc_clearance_state ← held_for_review`,
     with `compliance_lead` rationale appended.
3. Audit evidence retained: `kyc_operator` judgment,
   `compliance_lead` review action, and the original vendor
   match payload. Retention period: 7 years from case
   termination.

### Authority

The judgment is initiated by `kyc_operator` (any). The
acceptance is reserved to `compliance_lead`; not delegable
below role.

### Autonomy boundary

This decision class is never autonomous.
AI assistance permitted at: detection (proposing reason
code), evidence assembly, and audit-trail synthesis. AI
assistance not permitted at: judgment recording, judgment
acceptance, rejection rationale.

Closure status of the draft specification

Per the methodology, a PRISM (Process Resource and Interaction Specification) is considered "settled" when both the ClosureCompletion review (semantic and structural) and the Simulator review (deterministic and adversarial) report high confidence. The draft above has been through one ClosureCompletion pass at engagement end, returning the findings table below. Resolution of these findings is the principal remaining work in R-01.

None of these findings is exotic. Each is the kind of ambiguity a competent operator resolves silently. Each is also a place where AI deployed against the v0.4 draft would either fail or encode a specific resolution path that may diverge from the institution's intended one. The draft proceeds to v0.5 once these are resolved, then to Simulator review.

The full PRISM draft, including the unredacted findings, is delivered as nfg-onboarding-prism-v0.4.md alongside this report.

App. BInterviewees and source documents

Interviewees

The following individuals were interviewed during this engagement. Names are redacted in this version of the report at the request of Northway HR; the unredacted version is delivered separately to the engagement sponsor.

Source documents reviewed

Systems accessed (read-only)

Onboarding workflow system; KYC vendor portal; document-management system; customer master; ticketing system; compliance attestation log. Read-only access provisioned via Northway IT under engagement-specific credentials, deprovisioned at engagement close.

Methodology references

The methodology applied in this engagement is described in the Moschetti Consulting field notes series, available at moschetticonsulting.com/field-notes. The PRISM (Process Resource and Interaction Specification) format is described in field note №03; the failure-mode taxonomy underlying the findings classification is described in field note №02.

— End of report —