A FINRA examiner shows up. Regulation Best Interest. They want the full suitability reasoning behind trade T-88421 — every input to the model's recommendation, the KYC profile in force, the rep's added reasoning, and the model card. As of February 19, 16:42, the moment of recommendation.
Most wealth-management stacks can produce the first three. The fourth — proof that the model card itself hasn't been silently edited since the trade — is the question your stack probably can't answer with certainty. The model lives in MLflow. The card lives in a Notion page. The training-data fingerprints are in S3 (somewhere). Reproducing the exact card as it stood on February 19, with cryptographic non-modification proof, takes most firms a week of model-risk team time. And even then, the answer is "we believe it hasn't been edited."
So most firms hedge. Legal drafts a careful response. The examiner pushes back. The firm settles a small fine.
What Reg BI is actually asking
The care obligation in Reg BI has four prongs. Three of them — reasonable basis, suitability for the customer, and conflict of interest — are about the inputs to the recommendation. The fourth is about the integrity of the recommendation process: the firm must have a reasonable basis to believe the recommendation was in the customer's best interest at the moment it was made.
That last clause is bitemporal. The examiner doesn't want to know what's in the customer's best interest today. They want to know what was in the customer's best interest on February 19. The model version. The training data. The firm's risk policy. The customer's KYC. The market state at T-1 close.
If your firm runs on a bitemporal graph, all of that is one query.
The model-card integrity check
The harder question is whether the model card itself has been edited since the trade. Two checks answer it. First, list the versions of the card property:
CALL db.propertyHistory('model:alpha-rebalance-v7.3.1', 'card_uri')
YIELD value, validFrom, txnAt
RETURN value, validFrom, txnAtvalidFrom and txnAt are nanoseconds since the Unix epoch. In this illustrative example the query returns one row: the card URI written on 2025-10-12, with no later versions.
Second, GET /graphs/{name}/audit/verify re-hashes the graph’s write history and returns clean or the first broken record. The check covers the whole graph and has no date window. The history log is not signed or anchored outside the server, so the check does not detect a rewrite of the whole log, or removal of the most recent records, by someone with write access to the server. A clean result means no committed record, including the model's properties, was altered in place after it was written; a legitimate edit would appear as a new version in the first query.
The lineage walk
For the inputs to the recommendation, db.derivedFrom on the recommendation node follows DERIVED_FROM edges to the sources recorded for it: the customer's KYC profile, the current holdings, the previous day's market close, the model and its training-data fingerprint, and the firm's risk policy in force.
The examiner can run the same queries against the same deployment.
Regulation S-P portability
While the FINRA examination is in flight, the customer asks for their data under Reg S-P. db.subjectExport takes the string id of the customer’s node and returns one row for the node, one for each of its relationships and one for each recorded property version, with a JSON payload you can package and deliver. On a graph with no declared encrypted property it matches only the node whose string id equals the argument. A subject id held only in a property is not matched, and nodes created with Cypher CREATE or MERGE get a generated string id. An empty result does not show that the graph holds nothing about the subject. The export reads the records and does not change them.
The numbers
The figures in this post and in the walkthrough are illustrative. The history check detects a record altered in place; a re-fit or card change written through the normal write path appears as a new version with its own recorded time.