Which law does your policy answer to?

A credit policy is a legal object. It exists inside a body of law, and the person it evaluates is owed a specific document in a specific form when the answer is no. A lender in Ohio owes an adverse action notice. A lender in Hamburg owes a statement of reasons with three rights attached. A lender in Riyadh answers to their own Shariah board, and no statute prescribes the form at all.

Two of those three are a question of form. Serve the right document, in the right language, and the obligation is met. The third is not a question of form, and it is where most of this work went.

A policy declares its regime

Every policy document carries one field naming the legal system it answers to: a base (us, eu, or mena), an optional locality inside it, and optional overlays for obligations that are not territorial. The field is frozen into the published version, because "which law was this policy answering to" is a question an examiner asks about a specific version, years later. A setting that someone can flip cannot answer it. A frozen document can.

Publishing resolves the regime against a registry. An EU policy takes a member state as its locality, and a country that is not a member state refuses at publish, with the reason named. Set a tenant default once and every new draft carries your jurisdiction without anyone typing it.

The consumer document follows the policy

Ask for an explanation and the default form comes from the regime of the policy that produced the decision. A us policy serves the Regulation B adverse action rendering. An eu policy serves the CCD2 Article 18(8) statement, with the three rights it grants and a route to exercise each. A mena policy serves a statute-neutral statement of reasons: the same evidence discipline, the routes stated as routes the lender offers, and no article of anyone's law cited anywhere in it.

Asking for a form outside your regime is refused rather than served. A notice wrapped in another jurisdiction's legal claims is worse than no notice.

The statement also renders in Arabic, right to left. The payload carries its own language and direction, every factor in the reason vocabulary has an Arabic sentence, and anything that cannot be translated keeps its original text and is named as untranslated. A document that silently mixes languages reads as an error. One that says exactly which parts are not yet translated reads as what it is.

That is the half that is a question of form. Here is the half that is not.

The count was of the wrong population

A person finances a car through a murabaha, a home through a diminishing musharaka, and a laptop on an Islamic instalment plan. Three financiers, three sets of obligations. Ask a conventional credit system how many providers they are committed to and the answer comes back zero.

Nothing broke. The count works by matching counterparty names against a list of conventional instalment and BNPL providers, and none of those three financiers are on it. The number is accurate about the list and wrong about the person.

The direction of that error is what makes it worth writing about. It fails favourably. Someone carrying obligations on three sides looks like someone with room, right up to the moment a lender extends credit against it.

A longer list does not fix it

Add every Islamic financier in the Gulf to that list and the harder problem is untouched.

A financing instalment reaches us as one debit: a date, an amount, a counterparty. Nothing in that row separates the principal from the financier's return, and no arithmetic on our side can, because the split is a property of the contract and a transaction feed does not carry contracts. In this data, a murabaha instalment and an interest-bearing instalment are the same row.

So the obvious feature here was riba inference: decompose each outflow, work out which part is the financier's return, treat it differently. We did not build it. A calculation that claimed to tell those two rows apart would be inventing a distinction the data cannot support, wearing the costume of a measurement.

The line is between reading and inventing, not between having the answer and not having it. Where the data states the split, we read it. Interest that arrives labelled as interest is classified as interest, and a lender that sends an instalment as its components gets each component treated as what it says it is. Banks often hold that decomposition, because on those instalments the bank is the financier. What we refuse is deriving it from one opaque debit.

Shariah is an overlay, not a country

Shariah governance is not a territory. Islamic banks operate in London and Frankfurt as well as Riyadh and Cairo, and certification comes from an institution's own board rather than from a statute. So shariah composes with any base: an EU policy under the overlay is a valid regime, and so is a Saudi one.

What the overlay changes is what a policy is permitted to lean on. Four fact families, at two severities, with the reasoning sitting next to each one in the message the policy author reads:

• The BNPL provider count refuses to publish. This is the failure above. It is a count of the wrong population, and a rule thresholding on it would read a person financed entirely through Islamic instruments as unencumbered.
• Anything in the prediction family refuses to publish. An event contract pays on the outcome of an uncertain event, which the overlay does not recognise as an investment at all. A policy can still decline that trade outright: the asset class is not restricted, the behavioural read on it is.
• The debt service ratio publishes with a warning. It cannot separate a murabaha schedule from an interest-bearing one, but it still measures what leaves the account each month, and that is a real burden under any contract. Reported rather than barred, with an instruction attached not to read it as a measure of riba exposure.
• Revolving dependency publishes with a warning. Revolving behaviour is inferred from repayment cadence, not from the contract. A murabaha or ijara repaid on a revolving-looking cadence reads the same. The number describes the cadence honestly and says nothing about the instrument.

The two severities are the argument in miniature. Barring every fact a feed cannot be certain about leaves a lender with nothing to underwrite on. Claiming all of them leaves a number that fails favourably. The line runs where the data stops carrying the answer, it is drawn per fact, and it is drawn in writing.

The asymmetry that shaped the list

The two halves of riba have opposite data availability, and the restrictions follow the data rather than the doctrine.

Interest earned is derivable. A credit stamped as interest is identifiable as interest, so a fact reflecting income of that kind is not restricted here. Interest charged is not derivable, for the reason above, so the facts that would need it are the ones that got restricted. Whether interest income should count toward capacity under the overlay is a board question, and it is not ours.

The board certifies. We record.

Shariah governance has no statute to cite, which is what makes the record the compliance artifact rather than a formality sitting on top of one.

A policy under the overlay will not publish without a recorded attestation: the board's name, the approval's own reference, its date, and what was approved in the lender's own words. We record it and we never assess it. There is no version of this where we claim the certification ourselves, because it was never ours to make.

What has not been reviewed

Those four restrictions are engineering claims about what conventional bank data can support. No Shariah board has reviewed them. Each is registry data with its reasoning written beside it, so a board's decision is an edit rather than a rewrite, and each carries a provisional marker in the source the policy author's message comes from.

We would rather publish that paragraph than the one where the overlay sounds finished.