""" Build the AEGIS CYBER BoU Sandbox Application v2 docx. Applies the corrections identified in the platform-vs-document review: - PostgreSQL table count: 130 -> 296 (matches prod neondb) - Frontend page count: 90+ -> 190+ (matches client/src/pages) - React version: 19 -> 18 (matches package.json) - ML-KEM-768: "NIST-certified" -> "NIST-standardised (FIPS 203)" - FIDO2 passkeys: presented as current -> on roadmap; TOTP MFA is current - April 2026 "Grade A independent audit, all H/M resolved" -> internal AUDIT-CYBER-2026-05-15; 0 High, 4 Medium tracked in Legacy Carve-Outs Register v1.1 - PostgreSQL RLS in risk register -> application-layer RBAC + tenant-aware middleware (RLS on roadmap) - "Claude" naming removed per replit.md committed-file rule - Cover-page / Section 2.1 / Section 2.8 registration phrasing aligned """ from docx import Document from docx.shared import Pt, Cm, RGBColor from docx.enum.text import WD_ALIGN_PARAGRAPH from docx.enum.table import WD_ALIGN_VERTICAL from docx.oxml.ns import qn from docx.oxml import OxmlElement OUTPUT = "attached_assets/AEGIS_CYBER_BoU_SANDBOX_APPLICATION_v2_2026-05-17.docx" doc = Document() # ---------- Base style ---------- style = doc.styles["Normal"] style.font.name = "Calibri" style.font.size = Pt(11) def H(text, level=1): h = doc.add_heading(text, level=level) for run in h.runs: run.font.color.rgb = RGBColor(0, 0, 0) return h def P(text, bold=False, italic=False, align=None, size=None): p = doc.add_paragraph() if align is not None: p.alignment = align r = p.add_run(text) r.bold = bold r.italic = italic if size: r.font.size = Pt(size) return p def kv(label, value): p = doc.add_paragraph() r = p.add_run(label + ": ") r.bold = True p.add_run(value) def make_table(rows, header=True, col_widths=None): t = doc.add_table(rows=len(rows), cols=len(rows[0])) t.style = "Light Grid Accent 1" for ri, row in enumerate(rows): for ci, cell_text in enumerate(row): cell = t.rows[ri].cells[ci] cell.text = "" para = cell.paragraphs[0] run = para.add_run(cell_text) if header and ri == 0: run.bold = True if col_widths: for ri in range(len(rows)): for ci, w in enumerate(col_widths): t.rows[ri].cells[ci].width = w doc.add_paragraph() return t def hr(): doc.add_paragraph() # ============================================================ # COVER # ============================================================ P("THE REPUBLIC OF UGANDA", bold=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=14) P("BANK OF UGANDA", bold=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=14) P("National Payment Systems (Sandbox) Regulations, 2021", italic=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=12) hr() P("APPLICATION FOR APPROVAL TO OPERATE A SANDBOX", bold=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=13) hr() P("AEGIS CYBER", bold=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=20) P("Sovereign, Post-Quantum Resilient Digital Infrastructure — " "Continuity When the Network Fails", italic=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=11) hr(); hr() P("Submitted by", align=WD_ALIGN_PARAGRAPH.CENTER) P("AEGIS SOVEREIGN LIMITED", bold=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=14) P("Incorporated in the United Kingdom (Companies House No. 16991209). " "Uganda subsidiary registration with URSB in progress.", italic=True, align=WD_ALIGN_PARAGRAPH.CENTER, size=10) hr(); hr() P("May 2026", align=WD_ALIGN_PARAGRAPH.CENTER, bold=True) P("CONFIDENTIAL", align=WD_ALIGN_PARAGRAPH.CENTER, bold=True) doc.add_page_break() # ============================================================ # SCHEDULE 1 — APPLICATION FORM # ============================================================ H("SCHEDULE 1 — APPLICATION FORM", level=1) P("APPLICATION FOR APPROVAL TO OPERATE A SANDBOX", bold=True) hr() H("PART I — GENERAL INFORMATION", level=2) kv("Name of Applicant", "AEGIS SOVEREIGN LIMITED (operating AEGIS CYBER platform)") kv("Full Names of Substantial Shareholders, Managers and Directors", "Moses Mwesigwa — Founder & Director (Substantial Shareholder)") kv("Physical Address", "Kampala, Uganda (Operational HQ) | United Kingdom (Registered Office)") kv("Contact Details", "Email: M.Moses@eaiag.com") kv("Contact Person", "Moses Mwesigwa, Founder & Director") kv("Registration / Licensing", "United Kingdom Companies House Reg. No. 16991209 (incorporated). " "Uganda subsidiary registration with URSB in progress. " "Not currently supervised by another payment systems authority.") kv("Disputes or Enforcement Actions", "None. The applicant, its affiliated entities, shareholders, and " "employees are not party to any dispute or enforcement action.") hr() H("PART II — DETAILS OF THE SANDBOX PROPOSAL", level=2) kv("Description of the Innovative Product/Service", "AEGIS CYBER is a sovereign-grade AI-powered cybersecurity, compliance, " "and digital risk intelligence platform purpose-built for Uganda's " "payment ecosystem. It provides real-time fraud detection, perpetual " "KYC, SOAR automation, PCI-DSS and PDPO compliance, and BoU regulatory " "reporting — delivered as a multi-tenant SaaS. Full description " "attached in Section 1.") kv("Business Plan", "Full business plan attached in Section 2. Subscription-based SaaS " "model targeting banks, telecoms, SACCOs, government ministries, NGOs, " "and international development institutions.") kv("Current Stage of Development", "Production-ready platform. Approximately 296 PostgreSQL tables in the " "production database, 190+ frontend pages, and continuous internal " "security auditing (most recent: AUDIT-CYBER-2026-05-15, summarised in " "Section 1.4 and Section 5.2). Testing plan attached in Section 3.") kv("Key Risks and Mitigation", "Investor protection measures, data security safeguards, and market " "stability protections detailed in the Risk Management Framework " "(Section 5). Exit plan attached in Section 4.") kv("Financial Resources", "Platform development fully self-funded by the founder. Sandbox pilot " "operations will be financed from founder contribution and committed " "pilot institution engagement fees. Series A fundraising is underway " "targeting East Africa and UK institutional investors.") doc.add_page_break() # ============================================================ # SECTION 1 # ============================================================ H("SECTION 1: DESCRIPTION OF THE INNOVATIVE CONCEPT", level=1) H("1.1 The Problem", level=2) P("85% of African digital transactions depend on foreign-hosted " "infrastructure — a structural vulnerability that creates single points " "of failure, exposes institutions to infrastructure weaponisation and " "censorship risk, and leaves critical systems unable to operate when " "network connectivity is lost. Uganda's financial sector processes " "over UGX 100 trillion annually across mobile money, banking, and " "government payment channels. Yet the security and compliance " "infrastructure protecting that flow is largely imported, opaque, and " "priced for institutional balance sheets that most Ugandan supervised " "entities do not have.") P("The Bank of Uganda's 2026 Cyber and Technology Risk Management " "Guidelines create new obligations that most institutions are not yet " "equipped to meet. The Data Protection and Privacy Act 2019 requires " "verifiable audit trails, data subject access workflows, and breach " "notification processes. The FIA's AML requirements mandate 7-year " "retention of KYC records and Suspicious Activity Report filing. Most " "Ugandan financial institutions lack the technology to meet all these " "requirements simultaneously, and the global vendors that could meet " "them are priced out of reach for most of the market.") H("1.2 The Innovation", level=2) P("AEGIS CYBER is the first sovereign-grade, AI-powered cybersecurity " "and compliance intelligence platform designed and built specifically " "for the East African financial ecosystem. It consolidates into a " "single multi-tenant SaaS platform the capabilities that banks " "currently source from five to eight separate foreign vendors, at a " "fraction of the total cost of ownership, with full data residency in " "Uganda.") P("The platform's innovation lies in three dimensions. First, it uses " "artificial intelligence — specifically large language models accessed " "via a commercial AI provider's API — to analyse security threats in " "real time, replacing static rule engines with adaptive detection that " "learns from each institution's transaction patterns. Second, it " "implements perpetual KYC rather than periodic reviews, maintaining a " "continuous Digital Identity Pulse for every customer that updates in " "real time as new transaction, device, and behavioural signals arrive. " "Third, the Ghost Core failover module allows supervised institutions " "to continue processing essential transactions for a bounded period " "even when their core banking system or upstream connectivity becomes " "unavailable — a sovereignty capability without precedent in the " "region.") H("1.3 Payment Ecosystem Relevance", level=2) P("AEGIS CYBER directly supports the security and integrity of Uganda's " "national payment systems in the following ways. The platform's Know " "Your Transaction (KYT) engine performs real-time risk scoring on " "every transaction before it is processed, flagging structuring " "patterns, impossible travel, device anomalies, and flagged recipient " "accounts. The Ghost Core module maintains a shadow ledger of critical " "balances that allows supervised institutions to continue processing " "essential customer transactions for a bounded period during core " "banking system or upstream connectivity outages. The Regulator-in-" "the-Loop portal provides Bank of Uganda examiners with read-only " "supervisory visibility into institutional security posture, " "incidents, and SAR filings as they happen, rather than only at " "quarterly reporting intervals.") H("1.4 Technology Stack", level=2) P("The platform is built on production-grade open standards: a " "TypeScript/Node.js backend on Express, a React 18 frontend, " "approximately 296 PostgreSQL tables under Drizzle ORM, and " "deployment on containerised infrastructure with a dedicated production " "database (Neon-hosted PostgreSQL) attached to a Reserved VM. The " "security architecture incorporates the NIST-standardised ML-KEM-768 " "post-quantum key encapsulation algorithm (FIPS 203, August 2024) for " "inter-node communications and credential protection — adoption of a " "post-quantum primitive that is, to AEGIS SOVEREIGN's knowledge, " "without precedent in the East African market.") P("The platform's audit posture is managed under two paired artefacts. " "The AEGIS Security Audit (most recent run: AUDIT-CYBER-2026-05-15) " "is a 28-check audit of the deployed codebase and production database " "with full evidence-trail traceability. The AEGIS Legacy Carve-Outs " "Register (current version v1.1, dated 2026-05-15) records every " "deviation between the deployed platform and the AEGIS standard " "engineering posture, classified by residual risk with justification " "and target close date. The current audit identified zero High-" "severity findings; four Medium-severity items are tracked in the " "register with documented mitigation paths. Both artefacts are " "available for BoU review on request.") H("1.5 Benefits to the Payment Ecosystem", level=2) P("For supervised institutions, AEGIS CYBER reduces compliance costs by " "consolidating multiple vendor relationships into one subscription, " "reduces the risk of regulatory findings through automated compliance " "monitoring, and reduces fraud losses through AI-powered real-time " "detection. For payment system users, the platform increases " "confidence that their financial data is protected by modern " "encryption, that their identity is continuously verified to prevent " "account takeover, and that any incidents affecting their accounts are " "detected and remediated within hours rather than weeks. For the Bank " "of Uganda and other supervisors, the Regulator-in-the-Loop portal " "provides real-time supervisory visibility that materially improves " "the cadence and quality of cyber risk supervision across the " "ecosystem.") doc.add_page_break() # ============================================================ # SECTION 2 — BUSINESS PLAN # ============================================================ H("SECTION 2: BUSINESS PLAN", level=1) H("2.1 Executive Summary", level=2) P("AEGIS SOVEREIGN Limited is a technology company incorporated in the " "United Kingdom (Companies House Registration No. 16991209), with a " "Uganda subsidiary registration in progress with URSB, and operations " "across Uganda and the United Kingdom. AEGIS CYBER is its cybersecurity " "and compliance intelligence platform, purpose-built as a multi-tenant " "SaaS solution for the East African financial sector.") P("The platform is production-ready. The most recent internal security " "audit (AUDIT-CYBER-2026-05-15) identified zero High-severity findings; " "four Medium-severity items are tracked in the AEGIS Legacy Carve-Outs " "Register v1.1 with documented justifications and target close dates. " "The platform targets an addressable market spanning Uganda's 26 " "commercial banks, 45 microfinance deposit-taking institutions, 4 " "mobile money operators, 12 insurance companies, over 15,000 SACCOs, " "20+ government ministries and agencies, 500+ international NGOs and " "development projects operating in Uganda, and a growing private " "enterprise segment.") P("The founder, Moses Mwesigwa, authored Uganda's National AI Strategy " "(2026–2035) — a presidential-level, Vision 2040-aligned policy " "document — and represented Uganda's innovation agenda at the World " "Economic Forum in Davos in January 2026. The company seeks approval " "to operate within the BoU Regulatory Sandbox to validate the " "platform's payment security capabilities and obtain the operational " "evidence required to support full licensing and institutional " "rollout.") H("2.2 Vision and Mission", level=2) P("Vision:", bold=True) P("To become East Africa's sovereign cybersecurity infrastructure layer " "— the security backbone that every financial institution, government " "ministry, and enterprise relies on to operate safely in an " "increasingly digital economy.") P("Mission:", bold=True) P("To deliver enterprise-grade, AI-powered cybersecurity and compliance " "intelligence to African institutions at a price point and with a " "cultural context that makes security genuinely accessible — not a " "luxury available only to the largest banks.") H("2.3 Market Analysis", level=2) H("2.3.1 Total Addressable Market", level=3) P("Uganda's financial services sector manages assets exceeding UGX 50 " "trillion. Cybercrime losses across East Africa are estimated at over " "USD 4 billion annually by regional security authorities. The market " "for cybersecurity solutions in Sub-Saharan Africa is projected to " "reach USD 3.5 billion by 2027, growing at 15% annually, driven by " "regulatory mandates, mobile money proliferation, and increasing " "sophistication of fraud attacks. Within Uganda, the annual spend by " "financial institutions on cybersecurity and compliance tooling " "remains structurally under-served relative to need.") H("2.3.2 Serviceable Market — Uganda", level=3) P("Uganda's regulated financial sector comprises the following " "addressable segments:") make_table([ ["Segment", "Institutions", "Avg. Annual Budget (USD)", "Market Value (USD)"], ["Commercial Banks", "26", "150,000 – 400,000", "6.5M – 10.4M"], ["Microfinance Institutions", "45", "30,000 – 80,000", "1.4M – 3.6M"], ["Mobile Money Operators", "4", "200,000 – 500,000", "0.8M – 2.0M"], ["SACCOs (licensed)", "2,000+", "2,000 – 8,000", "4.0M – 16.0M"], ["Government MDAs", "30+", "50,000 – 200,000", "1.5M – 6.0M"], ["NGOs & Development Projects", "500+", "5,000 – 30,000", "2.5M – 15.0M"], ["Private Enterprises", "5,000+", "3,000 – 20,000", "15M – 100M"], ["TOTAL ADDRESSABLE (Uganda)", "—", "—", "USD 31.7M – 153M"], ]) H("2.3.3 East Africa Expansion", level=3) P("Kenya, Tanzania, Rwanda, and South Sudan represent a combined " "financial sector of over 200 commercial banks and 50+ million mobile " "money users. The regulatory environments in Kenya (CBK) and Rwanda " "(BNR) are broadly aligned with Uganda's BoU framework, reducing the " "compliance adaptation cost for regional expansion. AEGIS CYBER's " "multi-jurisdiction compliance modules — covering EAC, FATF, and " "individual country frameworks — are already architected for this " "expansion from the outset.") H("2.3.4 Competitive Landscape", level=3) P("Current competitors in the East African market fall into three " "categories: global enterprise vendors (IBM Security, Palo Alto, " "CrowdStrike) that are priced beyond the reach of most Ugandan " "institutions and require expensive implementation partners; regional " "point solutions that address only one problem (a KYC vendor, a fraud " "tool, a compliance scanner) without integration; and the manual and " "spreadsheet-based approaches still used by the majority of smaller " "institutions. Against this backdrop, AEGIS CYBER is positioned as the " "integrated, sovereign, AI-native alternative purpose-built for the " "East African context.") H("2.4 Product Description", level=2) P("AEGIS CYBER is delivered as a multi-tenant Software-as-a-Service " "platform. Each subscribing institution receives a fully isolated " "deployment environment with its own data residency, branding, and " "configuration. The platform's feature modules are grouped into six " "functional domains:") make_table([ ["Domain", "Key Capabilities"], ["1. AI Threat Intelligence", "Real-time threat detection, SOAR playbook automation, eBPF " "endpoint detection, threat hunting workbench, ZK threat exchange, " "behavioural biometrics, AI-powered threat scoring via integrated " "LLM provider"], ["2. Identity & Access", "Perpetual KYC with Digital Identity Pulse, Know Your Transaction " "(KYT) engine, TOTP-based MFA (FIDO2/passkey support on the " "platform roadmap), JIT privilege access, PAM with session " "recording, SSO/OIDC/SAML, SCIM 2.0 provisioning"], ["3. Compliance & Regulatory", "ISO 27001:2022 live tracker, SWIFT CSP, PCI-DSS audit logs, SOC2 " "evidence collection, PDPO/DSAR workflow, SAR auto-filing for FIA, " "BoU regulatory reporting, Regulator-in-the-Loop portal"], ["4. Payment Security", "Ghost Core shadow ledger (bounded autonomous operation during CBS " "outage), CBS transaction audit trail, mobile money protection, " "impossible travel detection, kill switch management, USSD and SMS " "last-mile channel security"], ["5. Operations & Resilience", "SOC command centre, shift handover management, SLA prediction, " "enterprise alerting, FinOps cost tracking, backup & DR, " "sovereignty readiness drills, cloud exit switch"], ["6. Risk & Governance", "Third-party risk management (TPRM), vendor DNA shield, supply " "chain integrity, AI-BOM, SBOM versioning, data classification, " "penetration test scheduler, bug bounty/VDP intake"], ]) H("2.5 Revenue Model — Subscription Tiers", level=2) P("AEGIS CYBER operates on an annual recurring subscription model with " "four tiers, calibrated to the size and regulatory complexity of each " "customer segment. All tiers include data residency in Uganda, " "continuous platform updates, and access to the BoU-aligned compliance " "modules.") make_table([ ["", "STARTER", "PROFESSIONAL", "SOVEREIGN", "ENTERPRISE"], ["Annual Fee (USD)", "4,800", "18,000", "36,000", "60,000+"], ["Annual Fee (UGX approx.)", "18M", "66M", "132M", "220M+"], ["Target Segment", "SACCOs, NGOs, Small MDAs", "Microfinance, Medium Banks, Telecoms", "Large Banks, Government, Development Banks", "Central Bank, SWIFT Members, Multinational Groups"], ["Users", "Up to 15", "Up to 50", "Up to 200", "Unlimited"], ["Data Residency", "Shared (Uganda)", "Shared (Uganda)", "Dedicated Namespace", "Dedicated Instance"], ["Threat Detection", "Standard", "AI-Enhanced", "AI-Enhanced + Hunting", "Full Sovereign Stack"], ["Compliance Modules", "PDPO, Basic AML", "PDPO, AML, BoU", "All + ISO 27001 + PCI", "All + SWIFT CSP + Custom"], ["Regulator Portal", "—", "Read-only", "Full Audit Mode", "Full + Sandbox"], ["SLA Uptime", "99.5%", "99.9%", "99.95%", "99.99%"], ]) P("In addition to base subscription fees, value-based overage charges " "apply for high-volume usage exceeding plan limits:") make_table([ ["Metric", "Included in Professional", "Overage Rate"], ["AI Threat Scoring (inference units)", "100,000/month", "USD 0.0008 per unit"], ["KYC Decisions (pKYC validations)", "5,000/month", "USD 0.10 per decision"], ["SAR Auto-Filing (FIA submissions)", "50/month", "USD 5.00 per filing"], ["Compliance Scans", "10/month", "USD 20.00 per scan"], ["API Calls (external integrations)", "500,000/month", "USD 0.00008 per call"], ]) H("2.5.1 Additional Revenue Streams", level=3) P("Professional Services: Implementation, configuration, and staff " "training are offered at UGX 2,000,000–8,000,000 per engagement, " "depending on institution size. These are one-time fees at onboarding. " "Regulatory Reporting-as-a-Service: For institutions that prefer to " "outsource their BoU cyber risk reporting and PDPO compliance filing, " "AEGIS SOVEREIGN offers a managed service at UGX 4,000,000 per " "quarter. Threat Intelligence Subscription: Financial institutions " "can subscribe to the East Africa Threat Intelligence feed — " "aggregated and anonymised from all platform participants — at " "USD 500 per month. This is a separate add-on available to all tiers. " "Government Platform Licensing: For Uganda Government ministries and " "constitutional bodies, a dedicated government platform licence is " "available at a negotiated bulk rate aligned with PPDA public " "procurement frameworks.") H("2.6 Customer Segments and Go-to-Market Strategy", level=2) H("2.6.1 Banking Sector", level=3) P("The primary commercial banking target is Uganda's tier-one and " "tier-two commercial banks. Initial pilot institutions identified " "include Pride Microfinance Bank, Centenary Bank, and Equity Bank " "Uganda. The sales approach leverages the founder's government " "relationships and policy credibility to secure introductions at " "Board and C-suite level. The BoU Regulatory Sandbox approval itself " "is a powerful credential — institutions that onboard during the " "sandbox period receive a co-branded 'Sandbox Partner' designation " "that signals regulatory alignment to their own auditors and " "examiners.") H("2.6.2 Telecommunications and Mobile Money", level=3) P("MTN Uganda and Airtel Uganda together process over 26 million " "mobile money accounts. These operators face AML obligations, SIM " "swap fraud, impossible travel attacks, and CBS integration security " "requirements that AEGIS CYBER addresses directly. The platform's " "USSD security and monitoring module provides a dedicated protection " "layer for USSD and A2A payment channels. Engagement with telco " "operators will proceed via technology and security leadership " "channels following sandbox validation.") H("2.6.3 SACCOs", level=3) P("Uganda has over 15,000 registered SACCOs. With the Parish " "Development Model channelling government funds through SACCO " "structures, their security posture has become a national priority. " "AEGIS CYBER's Starter tier at USD 4,800 per year (UGX 18 million) " "is specifically designed to be accessible to SACCOs at this scale, " "and the platform includes a dedicated SACCO security module " "covering member identity verification, transaction monitoring, and " "PDPO compliance reporting. The Uganda Cooperative Alliance and " "UCSCU provide natural channel partners for this segment.") H("2.6.4 Government Ministries, Departments and Agencies", level=3) P("Following the founder's authorship of the Uganda National AI " "Strategy and engagement with key ministries, AEGIS SOVEREIGN has " "established relationships with several government ministries and " "agencies that face growing cybersecurity and compliance " "obligations. These include the Uganda Revenue Authority, the " "National Housing and Construction Company, the Ministry of " "Agriculture, and the Ministry of Internal Affairs. Government MDAs " "are typically procured through direct procurement or restricted " "bidding under PPDA frameworks, and AEGIS CYBER's compliance and " "audit trail capabilities directly address the transparency and " "governance requirements that these institutions must satisfy under " "Uganda's public financial management reforms.") H("2.6.5 NGOs and International Development Projects", level=3) P("Over 500 international NGOs operate in Uganda, many handling donor " "funds governed by US FCPA, UK Bribery Act, and FATF anti-money " "laundering standards. These organisations require compliance tools " "that bridge Ugandan regulatory requirements with international " "donor reporting obligations. AEGIS CYBER's multi-framework " "compliance engine — covering PDPO, FATF, GDPR, SOC2, and ISO 27001 " "simultaneously — is uniquely positioned for this segment. Entry " "will be pursued through relationships with the Uganda National NGO " "Bureau and international development finance institutions including " "the IFC and AfDB.") H("2.6.6 Insurance and Other Financial Institutions", level=3) P("Uganda's insurance sector, supervised by the IRA, faces increasing " "cyber risk as digital claims processing and mobile insurance " "products proliferate. The 12 licensed insurance companies represent " "a Sovereign-tier segment. Engagement will follow banking sector " "validation.") H("2.7 Financial Projections", level=2) P("The projections below assume sandbox approval is granted in Q3 " "2026, with the first pilot institution live in Q4 2026 and " "commercial rollout commencing Q1 2027. Year 1 assumptions are " "deliberately conservative: institutions acquired during or " "immediately after a regulatory sandbox tend to begin at lower " "subscription tiers while they build internal confidence in a new " "platform. The Year 1 mix is therefore modelled as four Starter " "customers (USD 4,800/year), three Professional customers " "(USD 18,000/year), and one Sovereign customer (USD 36,000/year), " "yielding a blended average of USD 13,650 per institution. The " "upsell curve becomes visible in Year 2, as retained Year 1 " "customers upgrade tiers in response to demonstrated value, and new " "customers — who can reference sandbox evidence — enter at " "Professional and Sovereign tiers directly. By Year 3, the customer " "mix shifts materially toward Sovereign and Enterprise tiers as " "regulatory compliance mandates intensify across the sector. " "Projections are based on documented pipeline relationships and do " "not include government contract revenue which is subject to " "separate procurement timelines.") make_table([ ["Metric", "Year 1 (2027)", "Year 2 (2028)", "Year 3 (2029)", "Year 4 (2030)"], ["Paying Institutions", "8", "25", "60", "130"], ["Avg. Revenue per Institution (USD)", "13,650", "18,820", "23,760", "27,692"], ["ARR — Subscriptions (USD)", "109,200", "470,400", "1,425,600", "3,600,000"], ["Professional Services (USD)", "32,000", "80,000", "160,000", "250,000"], ["Threat Intel Add-on (USD)", "3,000", "20,000", "75,000", "180,000"], ["TOTAL REVENUE (USD)", "144,200", "570,400", "1,660,600", "4,030,000"], ["TOTAL REVENUE (UGX approx.)", "528M", "2.09B", "6.08B", "14.75B"], ["Estimated Gross Margin", "62%", "70%", "76%", "81%"], ]) P("The projections above are based on documented pipeline " "relationships with financial institutions and do not include " "potential government contract revenue, which is subject to separate " "PPDA procurement timelines and is treated as upside only. Series A " "capital will be deployed across four categories aligned with the " "commercialisation roadmap: 40% pilot deployment, 25% team and " "talent, 20% patents and IP filings, and 15% infrastructure. The " "committed investor milestones are: 100+ mesh nodes operational at " "month 12; 500+ nodes across 50+ institutions and Series B readiness " "confirmed at month 18.") H("2.8 Operations and Team", level=2) P("AEGIS CYBER is founder-led by Moses Mwesigwa, who combines public " "policy expertise — as author of Uganda's National AI Strategy — " "with deep technical capability as the lead architect of the " "platform. The founder has relocated from London to Kampala and " "maintains dual operational presence in both jurisdictions.") P("The sandbox phase will be supported by a lean operational team of " "four to six people, comprising platform operations (1), customer " "success and onboarding (1), compliance and regulatory affairs (1), " "sales and business development (1), and part-time engineering " "support (2). Full-time hiring will be funded from the first " "institutional contracts and any Series A capital. The platform is " "designed to require minimal operational overhead — the multi-tenant " "architecture means adding new institutions requires configuration, " "not bespoke engineering.") P("AEGIS SOVEREIGN's Uganda subsidiary registration is in progress " "with the Uganda Registration Services Bureau. The company holds a " "Technology Innovation Centre membership and has active engagement " "with the Uganda Communications Commission on matters of " "cybersecurity standards and digital infrastructure resilience.") H("2.9 Intellectual Property and Data Sovereignty", level=2) P("All code, algorithms, training data, and system architecture in " "AEGIS CYBER are wholly owned by AEGIS SOVEREIGN Limited. No " "third-party proprietary components are embedded that would " "restrict deployment, audit, or transfer of the platform. " "Open-source components are used under permissive licences (MIT, " "Apache 2.0) with full attribution. The platform is specifically " "architected to ensure that all data processed on behalf of Ugandan " "institutions remains within Uganda's borders, satisfying BoU data " "residency requirements and the data localisation provisions of the " "PDPO 2019. Patent applications covering the ML-KEM-768 mesh " "integration architecture, Hybrid Logical Clock transaction " "ordering, and the Sovereign Failover protocol are in preparation. " "They will be filed within the sandbox period, protecting the core " "innovations of the platform as exclusive intellectual property of " "AEGIS SOVEREIGN Limited.") doc.add_page_break() # ============================================================ # SECTION 3 — TESTING PLAN # ============================================================ H("SECTION 3: TESTING PLAN", level=1) H("3.1 Sandbox Objectives", level=2) P("The sandbox testing period will be used to validate three specific " "capabilities within a controlled regulatory environment: the " "accuracy and reliability of AEGIS CYBER's real-time KYT (Know Your " "Transaction) risk engine when processing actual payment " "transaction data from a participating institution; the operational " "readiness of the SAR auto-filing workflow with the Financial " "Intelligence Authority; and the effectiveness of the Regulator-in-" "the-Loop module in providing Bank of Uganda examiners with " "supervisory access. Secondary objectives include validating the " "platform's scalability under institutional transaction volumes, " "testing the USSD channel security module against live USSD traffic " "patterns, and collecting independent evidence of security and " "compliance performance for the Series A investor data room.") H("3.2 Pilot Institution", level=2) P("The primary sandbox pilot will be conducted with one Tier 2 or " "Tier 3 commercial bank or microfinance institution operating under " "BoU supervision. Pride Microfinance Bank Uganda has been " "identified as the preferred primary pilot partner, with Centenary " "Bank Uganda as an alternative. A Letter of Intent from the pilot " "institution will be provided to the Bank of Uganda alongside this " "application or prior to sandbox commencement. The pilot " "institution will participate under a signed Data Processing " "Agreement and a Sandbox Participation Agreement that clearly " "defines the scope of data sharing, the limitations on the sandbox " "environment, and the responsibilities of each party.") H("3.3 Sandbox Scope and Limitations", level=2) P("The sandbox will operate with production-equivalent but not " "production-connected systems. The pilot institution's transaction " "data will be replicated (not live) into the AEGIS CYBER sandbox " "environment. No actual payment instructions will be processed by " "AEGIS CYBER during the sandbox period — the platform will analyse, " "score, and report on transactions, but all payment execution will " "remain entirely within the pilot institution's existing payment " "infrastructure. This design ensures that any platform issue during " "the sandbox period cannot affect the integrity of the national " "payment system.") P("The sandbox scope is limited to: the Uganda jurisdiction; " "transactions denominated in UGX; and the specific modules " "identified in Section 3.1. Cross-border transaction analysis and " "the Ghost Core proxy mode (CBS failover) will be simulated in a " "dedicated test environment with synthetic data only.") H("3.4 Testing Schedule", level=2) make_table([ ["Phase", "Duration", "Activities"], ["1 — Onboarding", "Weeks 1–3", "Platform deployment, pilot institution data connection, staff " "training, baseline security assessment, PDPO Data Processing " "Agreement execution, sandbox environment verification"], ["2 — KYT Validation", "Weeks 4–8", "Run KYT engine against 90 days of historical transaction data; " "measure precision and recall against known fraud cases; tune " "thresholds for Uganda transaction patterns; validate " "structuring and AML detection rules"], ["3 — Compliance Testing", "Weeks 9–14", "SAR auto-filing workflow test with FIA; DSAR workflow test with " "pilot institution's DPO; ISO 27001 automated check validation; " "BoU quarterly report generation and review by pilot institution " "compliance team"], ["4 — Regulator Portal", "Weeks 15–18", "Bank of Uganda examiner access to Regulator-in-the-Loop module; " "sandbox stress test conducted with BoU observers; independent " "security verification by BoU technical team; formal feedback " "collection"], ["5 — Reporting", "Weeks 19–24", "Sandbox performance report compilation; independent auditor " "review; Series A investor evidence package; application for " "post-sandbox commercial licence; transition planning for pilot " "institution to production subscription"], ]) H("3.5 Success Criteria", level=2) P("The sandbox will be deemed successful if: (a) the KYT engine " "achieves a false positive rate below 5% and a true positive rate " "above 85% on the historical transaction dataset; (b) the SAR auto-" "filing workflow successfully generates and submits at least 3 test " "SARs in the format required by the FIA, with confirmed " "acknowledgement; (c) the Bank of Uganda technical team confirms " "the Regulator-in-the-Loop module provides sufficient supervisory " "visibility for examination purposes; (d) the pilot institution's " "compliance team confirms the platform reduces their monthly " "compliance reporting time by at least 30%; and (e) no critical or " "high security incidents are identified during the sandbox period.") H("3.6 Consumer Safeguards", level=2) P("AEGIS CYBER does not have direct interaction with payment system " "end users during the sandbox. All interaction is with the " "supervised institution's internal staff. However, the following " "safeguards protect the interests of the institution's customers: " "all personal data processed during the sandbox will be " "pseudonymised prior to ingestion; the AI threat scoring model " "will not make autonomous decisions affecting customer accounts — " "all decisions require human review and approval; the PDPO right-" "to-explanation module ensures any AI decision affecting a customer " "can be explained in plain language; and the platform's audit chain " "provides a tamper-evident record of all access to customer data, " "accessible to the pilot institution's Data Protection Officer at " "any time.") doc.add_page_break() # ============================================================ # SECTION 4 — EXIT PLAN # ============================================================ H("SECTION 4: EXIT PLAN", level=1) H("4.1 Voluntary Exit", level=2) P("If AEGIS SOVEREIGN Limited elects to voluntarily exit the sandbox " "before the expiry of the approved period, the following steps will " "be taken. Within 5 business days of the decision to exit, written " "notice will be provided to the Bank of Uganda's Director of " "National Payment Systems. Within 14 days, a final sandbox " "performance report will be submitted covering all testing " "activities conducted, findings, and any unresolved issues. The " "pilot institution will be notified simultaneously and provided " "with a data extraction package containing all their data in " "standard formats (CSV, JSON). Within 30 days of the exit notice, " "all pilot institution data will be securely deleted from the " "sandbox environment and a deletion certificate provided to both " "the pilot institution and the Bank of Uganda.") H("4.2 Regulatory Exit (Revocation or Suspension)", level=2) P("In the event that the Bank of Uganda suspends or revokes the " "sandbox approval, AEGIS SOVEREIGN will immediately cease all " "sandbox activities and cooperate fully with any investigation or " "examination. The pilot institution will be notified within 24 " "hours and will be assisted in transitioning their security " "monitoring to alternative arrangements at no cost during the " "transition period. All data will be handled in accordance with " "Section 4.1 procedures above, on an expedited timeline as directed " "by the Bank of Uganda.") H("4.3 Post-Sandbox Pathway", level=2) P("The primary intended exit from the sandbox is successful " "completion, leading to an application for a full commercial " "operating licence under the National Payment Systems Act 2020. " "Parallel to the sandbox, AEGIS SOVEREIGN will pursue: registration " "of the Uganda subsidiary with URSB; application to the UCC " "Technology Innovation Fund; and engagement with the BoU FinTech " "Regulatory Sandbox Programme for any payment-adjacent modules that " "require specific payment system licensing.") P("The pilot institution will be offered conversion to a standard " "commercial subscription at the Professional or Sovereign tier upon " "sandbox completion. The sandbox period constitutes the first 6 " "months of what is intended to be a multi-year enterprise " "relationship.") H("4.4 Data Handling on Exit", level=2) P("All customer data and transaction records belonging to the pilot " "institution are and remain the property of that institution. On " "exit, AEGIS SOVEREIGN will: (a) provide a complete data export in " "CSV and JSON formats within 5 business days; (b) confirm in " "writing that no copies of institutional data are retained beyond " "what is required for regulatory reporting obligations; (c) provide " "a cryptographic deletion certificate for all sandbox databases; " "and (d) cooperate with any independent audit of data deletion " "commissioned by the pilot institution or the Bank of Uganda.") doc.add_page_break() # ============================================================ # SECTION 5 — RISK MANAGEMENT FRAMEWORK # ============================================================ H("SECTION 5: RISK MANAGEMENT FRAMEWORK", level=1) H("5.1 Risk Governance", level=2) P("AEGIS SOVEREIGN's risk management framework is owned by the " "Founder and Director, Moses Mwesigwa, who serves as de facto " "Chief Risk Officer during the sandbox phase. A formal risk " "register is maintained and reviewed monthly. All risks are " "classified using a 5×5 likelihood-impact matrix. Risks rated High " "or Critical trigger an immediate escalation protocol and are " "reported to the Bank of Uganda within 48 hours of identification.") H("5.2 Technology Risk", level=2) make_table([ ["Risk", "Rating", "Mitigation"], ["Platform security breach", "Low", "Most recent internal security audit (AUDIT-CYBER-2026-05-15) " "identified zero High-severity findings; four Medium-severity " "items are tracked in the AEGIS Legacy Carve-Outs Register v1.1 " "with documented mitigations and target close dates. Controls " "include: field-level AES-256-GCM encryption for sensitive data; " "bcrypt password hashing on the primary authentication path " "(cost-factor variance across legacy code paths is tracked under " "register item CO-001); SHA-256 hash-chained audit logs; TOTP-" "based MFA (FIDO2/passkey support on the platform roadmap); " "application-layer RBAC with tenant-aware middleware (database " "Row-Level Security on the platform roadmap); 15-minute session " "timeouts."], ["Data loss or corruption", "Low", "PostgreSQL with automated daily backups, point-in-time " "recovery, and the Ghost Core shadow ledger providing real-time " "transaction replication. Backup integrity verified weekly."], ["AI model errors or bias", "Medium", "All AI decisions are advisory — no autonomous action is taken " "without human review. The Explainable AI module provides plain-" "language reasoning for every decision. The Safety Rails system " "prevents AI agents from exceeding defined action limits. Model " "drift is monitored continuously with automatic escalation if " "PSI thresholds are exceeded."], ["Platform downtime", "Low", "99.9% SLA with contractual penalties. Containerised " "architecture with automatic failover. Ghost Core module " "provides bounded autonomous operation if CBS connectivity is " "lost (precise window subject to sandbox validation)."], ["Third-party AI API failure", "Low", "Circuit breaker pattern implemented in ai-circuit-breaker.ts. " "If the upstream AI provider's API is unavailable, the platform " "falls back to rule-based threat detection automatically. No " "core functionality is dependent on a single external API."], ]) H("5.3 Regulatory and Compliance Risk", level=2) make_table([ ["Risk", "Rating", "Mitigation"], ["Non-compliance with PDPO 2019", "Low", "PDPO compliance is embedded in the platform architecture: DSAR " "workflow with 30-day SLA, right-to-explanation module for every " "AI decision, breach notification with 72-hour timer, data " "retention policies by category, DPO portal, and NITA-U " "submission automation."], ["Sandbox scope creep", "Low", "Sandbox operations are strictly bound to the scope defined in " "Section 3.3. Any proposed expansion of scope will require prior " "written approval from the Bank of Uganda."], ["Pilot institution dissatisfaction", "Medium", "A formal Customer Success Manager function is assigned to each " "pilot institution from day one. A Dispute Resolution Policy " "(Section 6) provides a clear escalation path. The sandbox " "participation agreement includes a 30-day exit right for the " "pilot institution."], ]) H("5.4 Market Stability Risk", level=2) P("AEGIS CYBER is a security monitoring and compliance tool — it " "does not hold customer funds, execute payment instructions, or " "participate in the settlement chain. Its failure or withdrawal " "cannot directly cause financial losses to payment system " "participants beyond the operational disruption of losing a " "security monitoring tool. This is fundamentally different from " "the stability risks posed by payment system operators or e-money " "issuers, and we submit that the market stability risk profile of " "this application is correspondingly low.") H("5.5 Investor Protection", level=2) P("AEGIS SOVEREIGN does not accept deposits, manage client funds, " "or operate as a financial intermediary. No retail investors or " "members of the public have any financial exposure to the " "platform. The only investors are AEGIS SOVEREIGN's equity " "holders, who have made informed investment decisions with full " "access to financial projections and risk disclosures. During the " "sandbox period, no new equity will be raised from retail " "investors.") H("5.6 Cybersecurity Incident Response", level=2) P("In the event of a security incident during the sandbox period, " "the following response protocol applies. Upon detection: " "immediate isolation of affected systems; notification to the Bank " "of Uganda and the pilot institution within 4 hours; engagement of " "the pre-identified incident response retainer. Within 24 hours: " "root cause analysis; assessment of scope and impact; notification " "to NITA-U if personal data is involved. Within 72 hours: full " "incident report submitted to the Bank of Uganda; remediation " "actions implemented; communications to affected parties. Post-" "incident: independent security review; updated security audit; " "lessons-learned report shared with BoU.") doc.add_page_break() # ============================================================ # SECTION 6 — DISPUTE RESOLUTION POLICY # ============================================================ H("SECTION 6: DISPUTE RESOLUTION POLICY", level=1) H("6.1 Scope", level=2) P("This Dispute Resolution Policy applies to all disputes arising " "from AEGIS CYBER's sandbox operations, including disputes between " "AEGIS SOVEREIGN and the pilot institution, disputes between AEGIS " "SOVEREIGN and the Bank of Uganda regarding sandbox conduct, and " "disputes between the pilot institution and its customers arising " "from actions taken based on AEGIS CYBER outputs.") H("6.2 Internal Resolution — First Level", level=2) P("Any dispute arising from sandbox operations will first be " "addressed through direct negotiation between the parties. The " "complainant must submit a written notice of dispute to the AEGIS " "SOVEREIGN Director at the registered contact address. AEGIS " "SOVEREIGN will acknowledge the dispute within 2 business days and " "provide a substantive written response within 10 business days. " "The parties will attempt to resolve the dispute by good-faith " "negotiation within 21 days of the dispute notice.") H("6.3 Escalation — Second Level", level=2) P("If the dispute is not resolved within 21 days, either party may " "escalate to mediation. A neutral mediator will be appointed by " "mutual agreement, or if the parties cannot agree, by the Uganda " "Mediation Centre. The cost of mediation will be shared equally " "unless the mediator determines otherwise. Mediation will be " "completed within 30 days of the appointment.") H("6.4 Bank of Uganda Notification", level=2) P("Any dispute that involves an allegation of: consumer harm; breach " "of data security or confidentiality; contravention of the " "National Payment Systems Act 2020 or its Sandbox Regulations; or " "conduct detrimental to the integrity of the payment ecosystem — " "will be notified to the Bank of Uganda Director of National " "Payment Systems within 48 hours of the dispute being raised, " "regardless of whether internal resolution is ongoing. The Bank of " "Uganda reserves its supervisory powers, including the right to " "suspend or revoke sandbox approval under Regulation 6.") H("6.5 Final Resolution", level=2) P("Disputes not resolved by negotiation or mediation will be " "referred to arbitration under the Arbitration and Conciliation " "Act, Cap 4 of Uganda, with proceedings conducted in Kampala. The " "arbitral tribunal will consist of a single arbitrator agreed by " "the parties. The governing law is Ugandan law.") H("6.6 No Waiver of Regulatory Rights", level=2) P("Nothing in this dispute resolution policy limits any party's " "right to report concerns to the Bank of Uganda, the Financial " "Intelligence Authority, NITA-U, or any other competent regulatory " "authority. Regulatory reporting is not a dispute and is not " "subject to this policy.") doc.add_page_break() # ============================================================ # APPENDIX — SUBMISSION DOCUMENTS CHECKLIST # ============================================================ H("APPENDIX: SUBMISSION DOCUMENTS CHECKLIST", level=1) P("The following documents are submitted as part of this " "application. Items marked [ENCLOSED] are included in this " "package. Items marked [TO FOLLOW] will be submitted separately.") make_table([ ["Reg.", "Document Required", "Status"], ["3(2)(a)", "Certified copy of the incorporation documents of the applicant", "ENCLOSED (UK Certificate of Incorporation; Uganda subsidiary " "registration in progress with URSB)"], ["3(2)(b)", "Certificate of good conduct for each substantial shareholder, " "manager and director", "ENCLOSED (Uganda Interpol)"], ["3(2)(c)", "Credit reference report for each substantial shareholder, " "manager and director", "TO FOLLOW (Uganda and UK credit bureaux)"], ["3(2)(d)", "At least two recommendation letters from persons of good " "repute", "ENCLOSED (from two senior public figures)"], ["3(2)(e)", "Copy of the dispute resolution policy of the sandbox", "ENCLOSED (Section 6)"], ["3(2)(f)", "Description of the innovative concept", "ENCLOSED (Section 1)"], ["3(2)(g)", "Testing plan", "ENCLOSED (Section 3)"], ["3(2)(h)", "Copy of the business plan", "ENCLOSED (Section 2)"], ["3(2)(i)", "Risk management framework", "ENCLOSED (Section 5)"], ["3(2)(j)", "Proof of payment of application fees (UGX 1,000,000)", "TO FOLLOW (bank payment slip)"], ["3(2)(k)", "Exit plan", "ENCLOSED (Section 4)"], ["Schedule 1", "Completed Application Form (Schedule 1 to the Regulations)", "ENCLOSED (Page 2)"], ["Schedule 2", "Fit and Proper Person forms for substantial shareholders, " "managers and directors", "TO FOLLOW (Moses Mwesigwa — Founder)"], ]) P("Note on items marked TO FOLLOW: Items requiring original " "certificates (good conduct, credit reference) and notarised " "documents will be submitted within 14 days of this initial " "application. AEGIS SOVEREIGN requests that the Bank of Uganda " "begin its review of the enclosed substantive materials while " "these supporting documents are being prepared.") P("Supporting security artefacts available on request:", bold=True) P("• AEGIS Security Audit AUDIT-CYBER-2026-05-15 (executive summary " "and full JSON with disposition post-script)") P("• AEGIS Legacy Carve-Outs Register v1.1 " "(AS/INTERNAL/2026/CARVEOUTS-CYBER-v1.1, 2026-05-15)") doc.add_page_break() # ============================================================ # DECLARATION # ============================================================ H("DECLARATION", level=1) P("I/We declare that all information given in this application and " "in the attached documents is true and correct.") hr(); hr() P("Signed: ..............................................................") hr() P("Name: Moses Mwesigwa") hr() P("Position: Founder & Director, AEGIS SOVEREIGN Limited") hr() P("Date: ..............................................................") # ---------- save ---------- doc.save(OUTPUT) print(f"Wrote: {OUTPUT}") import os size_kb = os.path.getsize(OUTPUT) / 1024 print(f"Size: {size_kb:.1f} KB")