OpenClearThe OpenClear documentation, built from the repository on every release. It covers installing and running OpenClear, onboarding a bank or a business customer, the JSON API, and how OpenClear maps to the guidance banks are examined against.
Using OpenClear
Setup and deploymentMulti-tenant positive pay platform (checks + ACH today, extensible to other payment networks — see networks/) with pluggable OCR and an ML-assisted…Runbook: new bank or customerThis is a standalone version of the in-app "Getting Started" checklists (/ui/wizard/bank and /ui/customers/{id}/wizard) — useful for reading or…JSON APIAll endpoints are prefixed with /api/v1. This is the JSON API surface — it exists alongside (and, where equivalent, is backed by the same services as)…ArchitectureHow OpenClear is put together, and why. It's written for engineers changing the code. For setup and deployment see README.md, for the JSON API see…PluginsA plugin adds to OpenClear without changing its code. It's a separate Python package that OpenClear finds when it starts.ChangelogFiles and verification (OWASPPLAN.md OW4):
Compliance
Compliance overviewThese pages are for a bank's compliance, risk and audit staff, and for examiners. They map what OpenClear does onto the guidance a bank is examined…FFIEC IT HandbookHow OpenClear supports the areas the FFIEC IT Examination Handbook booklets examine, chiefly Information Security, Architecture, Infrastructure, and…Nacha Operating RulesHow OpenClear supports a bank's obligations as an RDFI under the Nacha Operating Rules, for its ACH positive pay and unauthorized-debit handling. Check…Model risk (SR 11-7)OpenClear makes decisions with two kinds of model, in the sense of the Federal Reserve's SR 11-7 and the OCC's Bulletin 2011-12, Supervisory Guidance…Third-party riskThe 2023 Interagency Guidance on Third-Party Relationships: Risk Management (Federal Reserve, FDIC and OCC) asks a bank to manage each third-party…OpenClear's controlsWhat OpenClear itself does to meet each control objective, filed under the NIST SP 800-53 Rev. 5.1.1 controls it carries out. Several rely on the bank,…CUECsOpenClear's controls rely on the people using it to do their part: a bank, its business customers, and whoever runs OpenClear. These are those parts,…NIST CSF 2.0OpenClear's controls and the complementary user entity controls (CUECs) by NIST Cybersecurity Framework 2.0 subcategory. Both inventories are filed…OWASP ASVSOpenClear measured against the OWASP Application Security Verification Standard 5.0, at Level 2, and Level 3 in V6–V11 and V16 (ADR 0001). The…Check law (UCC, Reg CC)Positive pay exists because of two things: who bears a check-fraud loss, and how fast a paying bank must return a check. This page says what OpenClear…GLBAFor an FDIC-supervised bank the Gramm-Leach-Bliley Act's safeguards are 12 CFR Part 364, Appendix B, with Supplement A on responding to unauthorized…NYDFS Part 500New York's cybersecurity regulation, 23 NYCRR Part 500, binds banks licensed under the New York Banking Law. It doesn't bind OpenClear. But section…Incident notificationThree rules decide who hears about an incident involving OpenClear, and when. This isn't legal advice (Compliance).Check fraud, SARs and OFACWhat the Bank Secrecy Act's suspicious activity reports and OFAC's sanctions ask of a bank, where positive pay touches them, and what OpenClear does…State rulesOpenClear's banks are state-chartered, so their state banking department examines them alongside the FDIC. OpenClear takes New York DFS Part 500 as its…CRI ProfileThe Cyber Risk Institute's Profile is the financial sector's version of the NIST Cybersecurity Framework 2.0: 318 diagnostic statements a bank answers…AccessibilityOpenClear aims to meet WCAG 2.2 Level AA. This page says what's checked automatically, what isn't yet, and what a VPAT for OpenClear would contain. It…NIST AI RMFOpenClear has one AI system: each bank's own fraud-scoring model, a logistic regression trained only on the decisions the bank's people made. It's off…CFPB Section 1033Read 22 October 2026: 12 CFR Part 1033 (eCFR; unchanged since 17 January 2025); the CFPB's advance notice, 90 FR (FR Doc. 2025-16139); the CFPB's…Security metricsFor OpenClear 1.31.0, released 2026-10-29: part of the due-diligence pack (third-party risk). Each release's notes on GitHub carry the same figures for…
Integration guides
Teller verificationWhen someone cashes a business customer's check at a branch, your teller platform can ask OpenClear first: was this check issued, for this amount, to…Connecting a GRC toolOpenClear tests its own controls continuously, and proposes attestations of the complementary user entity controls (CUECs), the things OpenClear relies…Connecting a SIEMOpenClear records sign-ins and their failures, lockouts, second factors, API tokens, refusals, and changes to who may do what as security events. This…Connecting a BI toolOpenClear doesn't have a reporting dashboard of its own. Banks already run a business intelligence platform (Power BI, Tableau, Looker, Qlik, or an…Edge and WAFMost banks put a web application behind an edge network: Cloudflare, Akamai, AWS CloudFront with AWS WAF, Azure Front Door, or an F5. It terminates…EmbeddingA bank's business customers can review and decide their positive pay exceptions without leaving the bank's online banking. This guide is for the online…CertificationThis is how a core, an online banking provider, or a bank's own systems show that their OpenClear integration does what banks rely on.
Security
Security policyReport it privately through GitHub: Report a vulnerability. Please don't open a public issue, pull request or discussion about it.AuthenticationHow people and systems sign in to OpenClear, how strongly each way is protected, and how sessions work. It answers ASVS 5.0 6.1.1, 6.1.3, 6.3.4,…AuthorizationWhat decides what someone may do and see in OpenClear. It answers ASVS 5.0 8.1.1–8.1.4. Terms are as in CONTEXT.md.CryptographyEvery key and secret OpenClear uses, what protects it, and how it's rotated. It answers ASVS 5.0 11.1.1–11.1.4. The libraries are cryptography, bcrypt,…Data and limitsWhat OpenClear accepts, how it checks it, what limits protect it, and every outside system it talks to. It answers ASVS 5.0 2.1.1–2.1.3, 5.1.1, 13.1.1,…Threat modelHow OpenClear could be attacked, and what stops it. It's kept as code with OWASP pytm (threatmodel/openclear.py) so it changes in the same pull request…Security reviewDate: 2026-07-28 Scope: all features shipped to date (multi-tenant/customer core, auth + federated SSO + WebAuthn, users/security groups/Bookkeeper…