Change verification for finance models
Show that the changed calculation still computes the approved one.
A vendor ships a release. ISDA recalibrates SIMM. A quant team refactors a pricing routine. Hineni compares the approved reference implementation with the changed version using exact arithmetic and writes a signed report your validation team can file and your counterparty can re-check without your code.
- profile
- simm-crif
- reference
- simm-rs, SIMM v2.6
- changed
- simm-rs, SIMM v2.7
- rows
- 10 portfolios, C108 to C117
- arithmetic
- exact, no tolerance
- verdict
- DIFFERENT on rows 1 to 10
- scope
- conditional on the recorded path
- signature
- Ed25519, valid
The problem
Every approved model keeps changing after approval.
Model risk guidance in the US, UK and Canada expects a bank to confirm that the code in production implements the approved model, including vendor models whose source it never sees. The usual evidence is a parallel run on a sample of trades and a reconciliation of the breaks.
- SIMM recalibrationISDA moved SIMM to a semiannual calibration cycle in 2025. Every vendor and every in-house engine updates parameters twice a year.
- Vendor releaseThe bank receives a new build of a margin or pricing engine and cannot read the code.
- Refactor or portA routine is rewritten for speed, moved to a new language, or moved to a new library.
The report
One change, one signed report.
The change verification report states, for the rows you supply, whether the changed version computes the same function as the approved reference. It records the rows, the branches those rows reached, whether repeated captures agreed, and how many floating-point outputs were bit-identical. Every report carries one of four verdicts.
EQUAL
Both versions compute the same function on the supplied rows, and every recorded branch was seen both ways.
DIFFERENT
The versions compute different functions. The report names the rows.
INCONCLUSIVE
Some branch was seen only one way, so Equal is not claimed. The report names the missing branch outcomes.
REFUSED
The change exceeds the configured time budget. Nothing is certified and the report says why.
Samples you can run
SIMM 2.6 to 2.7 and three scalar changes.
These come with the app. The SIMM tapes are captured from simm-rs, an open-source SIMM engine (MIT licence), on its own public test portfolios. The scalar functions are written for the demonstration.
| Sample | Change | Verdict printed on the receipt |
|---|---|---|
| SIMM 2.6 to 2.7 | Ten portfolios, tapes captured under each version | DIFFERENT on rows 1 to 10, conditional on the recorded path |
| SIMM 2.6 rerun | The same engine captured twice | INCONCLUSIVE (coverage): some branches seen one way only, add rows |
| Equal refactor | A rate-margin function with operands reordered and terms factored | EQUAL on 8 rows |
| One coefficient changed | 0.01 becomes 0.015 in the negative branch | DIFFERENT on rows 2, 4, 6, 8 |
| Unsupported library | The new version imports a numerical library outside the supported set | REFUSED, with the reason and the next step |
ISDA SIMM is a trademark of the International Swaps and Derivatives Association, Inc. Adoria Labs is not affiliated with ISDA. Hineni checks the implementation you supply and does not ship SIMM parameters.
Who uses the report
Four teams, the same document.
Model validation and model risk
File one report per change against the approved reference, in place of a parallel-run reconciliation.
SIMM and margin product owners at vendors
Ship each release with a signed report clients can re-check, without sending source code.
Vendor and third-party risk
Accept a delivered build against the pinned reference before it reaches production.
Quant and risk technology
Rewrite or port a routine and attach the report to the pull request.
Deployment
Built for a bank workstation.
Local only
A desktop app with a local server bound to 127.0.0.1. No account, no upload, no outbound connections. Python standard library only.
Signed receipts
Each receipt is signed with Ed25519 and pins the checker that produced it by hash. Banks can issue a signer card so receipts read "Approved signer".
Offline re-check
A counterparty opens one HTML page, chooses the receipt, and sees Computation, Signature and Signer trust. No install and no network.
macOS build signed and notarized by Apple. Windows and Linux run from the Python package. A security and network note for software intake is available on request.
Pilot
One approved model, one quarter of changes.
Scope call, 30 minutes
Pick one approved reference implementation and the changes made to it over a quarter.
Run inside your environment
Hineni runs on your machine with your rows. Your code and data stay with you.
One report per change
Your validation team receives a signed change verification report for each change, ready to file.