NASD OTC Securities ExchangeA Self-Regulatory Organisation, registered with and
regulated by the Securities and Exchange Commission, Nigeria
NASD NEXT · GATE SERIES · 03 · FAILURE MODES

Failure modes and responses

v2 · 22 Jul 2026 · twelve entries, budgeted · companions: 01, 02, 04
THE LOGIC WE ARE AIMING FOR

Failures here are budgeted, not feared: caps bound the money, snapshots bound the liability, hooks bound the data, honesty bounds the trust damage. Safeguarding means keeping every failure inside the budget it was given.

Below: the severity ladder, the one split and one direction the whole catalogue obeys, and the twelve entries with what bounds each.
HOW TO THINK ABOUT SAFEGUARDING IT

How failures are contained

The design pre-spends its risk: caps bound the money, snapshots bound the liability, hooks bound the data, honesty bounds the trust damage. Safeguarding is keeping every failure inside its budget.
SEV LADDER

What outranks what

SEV-1Identity integrity: two objects for one BVN, chain tamper, attestation forged. These threaten the thing everything else stands on.
SEV-2Funds and custody: rebind takeover, cap enforcement failure, exit-ramp breach.
SEV-3Availability: NIBSS, store, rails, panel. Painful, bounded, survivable, because the discipline below holds.
THE DISCIPLINE

One split, one direction

THE SPLITOnboarding fails closed · trading fails open · display fails cached. Different paths earn different failure rights.
THE DIRECTIONUnder stress the system sheds speed, never legality. The degraded mode is always the slower lawful path.
THE PATTERNEvery response below is the same five beats: detect → bound → tell the truth → take the lawful path → ledger it.
THE CATALOGUE

The catalogue: twelve failure modes

F1 · NIBSS UNREACHABLE · SEV-3

Minting pauses, honestly

BOUNDED BYFail-closed mint; existing users untouched
RESPONSEVisible retry state with a working retry. Never open accounts on self-declared data: BVN is the dedupe key and the one-account rule dies without it.
STATE SHOWN“Identity checks are briefly delayed on the national rail. Your details are safe; retry shortly.”
F2 · STORE DEGRADED · SEV-3

Split the paths

BOUNDED BYStrong consistency on provenance writes only
RESPONSEMint pauses (closed) · attested users trade on broker rails (open) · reads serve cached with stale stamps (cached)
F3 · DUPLICATE BVN / CONCURRENT MINT · SEV-1

One object, always

BOUNDED BYIdempotent mint resolution
RESPONSESecond session → account recovery. Two objects for one BVN is a sev-1 data event, not a ticket.
F4 · SCREENING STALLS OR FAILS POST-L1 · SEV-2

The caps do their job

BOUNDED BY₦200k cumulative, by the regulator's own rule
RESPONSEStall: truthful countdown at L1; chronic breach feeds allocation weighting. Fail: FROZEN-AT-L1 → exit ramp R6.
F5 · CHN PIPELINE STALLS · SEV-2

The systemic one

BOUNDED BYCircuit breaker holds new users at L1 caps: bounded trapped value
RESPONSESETTLING countdown switches to real queue times. This is the original funding wall one gate right; the breaker exists so it can never silently recur.
STATE SHOWN“Your market number is queued at CSCS; the queue is running at N days. Buying stays open under your limits.”
F6 · REBIND ATTACK · SEV-2

The worst headline

BOUNDED BYEnrolled-template liveness, cooling window, step-up
RESPONSESuspected takeover freezes withdrawals, never market data. Comms within the hour: honest state applies to incidents too.
F7 · EVIDENCE API ABUSE · SEV-2

The exfiltration channel

DETECTA broker pulling more trails than it has clients, the simplest alarm in the book; plus grant checks, rate ceilings, watermarks
RESPONSEGrant suspension, pause switch, read-ledger extract to both compliance officers
F8 · INSIDER ACCESS · SEV-1

Watch the watchers

BOUNDED BYTokenised index, separately-keyed vault, HSM keys: leaking the index does not leak the vault
RESPONSEInternal reads sit on the same ledger; anomaly review over internal principals
F9 · PANEL EXHAUSTED · SEV-3

Nowhere to allocate

BOUNDED BYMinimum panel size as contract (C1), capacity signalling
RESPONSEBelow minimum: minting continues to OPEN, attestation queues with a truthful ETA
F10 · VBANK RAIL DOWN · SEV-3

Money pauses, market does not

RESPONSEFunding and cash-out pause with honest status; trading intact. One honest rail beats a hasty second rail that breaks the funding-source rule.
F11 · PANEL AGREEMENT CHALLENGED · SEV-2

The legal outage

BOUNDED BYThe drilled fallback
RESPONSEExplicit choose-your-broker flow takes allocation's place: slower, lawful, rehearsed quarterly
F12 · CHAIN TAMPER SUSPECTED · SEV-1

Anchors answer

DETECTRoot mismatch vs published, broker-witnessed anchors
RESPONSEQuarantine range, re-verify attestations against broker-held copies, disclose per runbook. The witnessed root makes this provable, not arguable.

Review rule: a proposed feature names which entries it can trigger and which budget it spends. A feature with no failure entry is a feature not yet designed.