- Apple and Goldman Sachs had thousands of engineers and billions in revenue. A single UI change still silently dropped tens of thousands of valid billing-error disputes into a dead state nobody could see. The CFPB found it. They paid $89 million. 🧵
- June 2020: Apple added a secondary form to the Apple Card dispute flow. Submit the dispute in Messages but skip form B, and the system marked it "incomplete." No routing to Goldman. No investigation. No 30-day acknowledgment. The consumer ate the charge.
- Under Reg Z §1026.13, those Messages submissions were often valid Billing Error Notices. The creditor must acknowledge within 30 days and resolve within two billing cycles. Instead the disputes sat in a state with no path to investigation at all.
- That's not a paperwork problem. It's a state-machine problem. The workflow had a reachable state — form A submitted, form B pending — with no transition out to "investigation initiated." A model checker exploring every reachable state finds that dead state in seconds.
- Apple and Goldman had ONE integration point between two systems. Most large issuers have 10–15 systems touching a single dispute: network portal, case management, core ledger, letter generation, credit reporting, provisional credit engine, routing queues.
- Every API update, partner integration, or UI tweak opens new paths through that maze. Any path can introduce a new dead state. Testing checks the paths you anticipated. It can't check the ones you didn't. That gap is where $89M consent orders are born.
- Now stack the clocks. One dispute can be governed at once by Reg Z (30/90 days), Reg E (10/45), Visa VCR (30/70/100), and Mastercard's own timeline. When they collide, compliance depends on a human remembering which deadline wins.
- The market doesn't solve this. FINBOA and Quavo automate dispute processing. Imandra does formal verification in finance — Goldman is a client — but for trading algorithms, not consumer disputes. Nobody proves a workflow can't violate Reg Z. They make it faster, not provable.
- We build the proof. We model your dispute workflow as a state machine and verify that every reachable path satisfies every applicable deadline — Reg Z, Reg E, Visa, Mastercard — at once. Not "we tested it and it worked." Proof that it can't fail.
- Regulators are moving the same way. OCC Bulletin 2025-26 treats any AI that drives compliance decisions as a "model" that must be validated. Formal proof is the strongest model validation there is — and the cleanest way to show a board the process can't break.
- If your dispute workflow changed last quarter, can you prove no path now drops a Reg Z notice past day 30 — or are you just trusting that nobody touched the wrong system? #RegTech #BankingCompliance
- We wrote up the full state-machine teardown of the Apple-Goldman dead state and how formal verification prevents the next one: https://veriprajna.com/solutions/financial-compliance-verification