Model laundering — the correlation assumption that became a triple-A, and what the triple-A was doing

What it is

In the years before 2008, a chain of American financial institutions took a judgment — how likely is it that many subprime mortgages go bad at the same time? — converted it into a number, fed that number into a rating model, and got out the other end a symbol, AAA, that regulators, investment mandates, money-market rules and bank balance sheets were built to accept without argument. The number was a correlation assumption. Across the two agencies that between them rated 85% to 95% of all collateralised debt obligations, its value was 0.3 or close to it. Nothing about it was hidden; it was in the published methodology. What it did was change the status of an opinion. Before the model, the belief that subprime mortgage bonds from different pools would default largely independently of one another was a contestable view held by some people at a rating agency. After the model, it was a rating, and a rating was a thing a pension fund's investment policy could point at, a thing a capital rule could key off, a thing that no longer had a person attached to it whom you could ask to justify the belief.

That change of status is what this entry means by model laundering. Not that the model was wrong — a model can be right and still do this — but that a quantity too weak to bear institutional weight was made to bear it, because passing through a computation stripped the quantity of its provenance. The laundering is in the transformation from someone thinks to the model says, and from the model says to the rule requires.

On the filing, and on the name

canon/proposals.md lists this under interpretation, and after working the alternatives the filing holds — but it holds for a reason worth stating, because the obvious rival is moment and the rival is not silly. The 2008 financial crisis is about as moment-shaped as an event can get: dated, documented, investigated by two congressional bodies and a presidential commission. If this entry were the crisis, moment would be right and the file would be economic history.

It is not the crisis. It is a reading of one part of the crisis — the claim that a model's output can acquire standing its inputs cannot support, and that when this happens the failure usually lives not in the mathematics but in what an institution did with an output. That is an empirical claim about how organisations behave, with a mechanism and a documented instance, which is what interpretation holds in this canon. The precedent is already here: content-farms-2016 takes a dated event and is filed interpretation, because the entry is the reading and not the event. The same test that goodharts-law-1975 applied to itself applies here — a limit tells you a region is empty and has a proof; nothing below is proved, and nothing below forbids anything.

idea fails for the entry as written, because there is no loop and no formalism here to implement. There is an implementable formalism inside the story — the Gaussian copula, and specifically David X. Li's On Default Correlation: A Copula Function Approach, published in the Journal of Fixed Income 9(4) in March 2000 after circulating as RiskMetrics Group working paper 99-07 in 1999. A separate idea entry for the copula would be a legitimate entry. It is not in canon/, I am not writing it here, and I am not inventing an id for it.

The name needs the same treatment. "Model laundering" is not a term of art from the crisis literature and I could find no source that uses it for these events. The terms the record actually uses are ratings shopping, regulatory arbitrage, and — for the specific move of taking a BBB-rated tranche and reissuing most of it as AAA — simply the arbitrage. The nearest coinages come from elsewhere and from later: mathwashing, coined by Fred Benenson in June 2016 for using mathematical vocabulary to paper over a subjective reality; AI data laundering, Andy Baio's September 2022 term for the academic-to-commercial pipeline that launders provenance out of training corpora. I am keeping the id because the id is what was filed and what other entries already reference, but a reading that cites this entry should quote the mechanism, not the phrase, because the phrase will not be found in the sources.

year: 2008 is the crisis year and the year the internal documents became public. The dated spine of the entry runs 1999 to 2011.

The machine, in the order it was built

A subprime mortgage-backed security pooled mortgages and sold claims against them in ranked tranches. Roughly four-fifths of a typical one was rated AAA — the schematic MacKenzie takes from Lucas (2007) gives 81% AAA, 11% AA, 4% A, 3% BBB, and about 1% first-loss, plus excess spread and overcollateralisation. Everyone knew the underlying mortgages would default at rates far above prime. The AAA tranche was rated AAA because the losses would have to eat through everything below it first.

The agencies rated these things without modelling correlation explicitly at all. MacKenzie is precise about this: in the evaluation of mortgage-backed securities "there was almost no explicit modeling of statistical dependence among mortgage defaults." Dependence was handled procedurally — S&P used the default rates of the Great Depression as the stress scenario a AAA tranche had to survive; geographically concentrated pools were discouraged by ratings penalties. What looked like an assumption of independence was, in an interviewee's phrase, only "conditional independence": independence conditional on the macroeconomic scenarios that the historical stress cases already encoded. Crude, but the crudeness was legible and its conservatism was on the surface.

CDOs went the other way. They had been built since the late 1980s out of corporate bonds and loans, and by the mid-1990s they were the property of banks' derivatives teams rather than their securitisation desks — people for whom an explicit mathematical model was the only respectable way to evaluate anything. Oldrich Vasicek had shown in 1991 how option theory could value a large homogeneous portfolio of corporate loans; J.P. Morgan generalised it into CreditMetrics; Li's 1999–2000 papers brought the copula function from actuarial science and made what everyone had been doing legible as one family. Procedural methods began to look shabby — as a rating agency employee of the period told MacKenzie, the old practice of "notching" was "not a proper correlation method." All three agencies switched to Gaussian-copula software: S&P's CDO Evaluator in November 2001, Fitch's Vector in July 2003, Moody's CDOROM in May 2004.

Making correlation explicit forced someone to pick a number, and here is the hinge of the whole entry:

> the assumption of low levels of correlation was at the very core of the > rationale for CDOs, especially arbitrage CDOs. > — MacKenzie, AJS 116(6), 2011, p. 1804

Low correlation is what makes a pool of mediocre credits into a mostly-excellent security. High correlation destroys the trick: if things default together, no amount of tranching gets you a large safe piece. The number chosen by S&P for the correlation between corporations in the same industry, in the original 2001 Evaluator, was 0.3 — and MacKenzie's interviewee says why:

> The value 0.3 was chosen "partly to maintain consistency with the previous > notching scheme": when applied to similar asset pools it tended to generate > similar results, that is, similar ratings and credit support levels. > — MacKenzie, p. 1806

That is the sentence to hold onto. The parameter was not estimated from the world. It was reverse-engineered from the answers the old procedure had been giving, so that changing the method would not change the ratings. The correlation between corporations in different industries, in that first version, was set to zero.

The transfer

ABS CDOs — CDOs whose assets were tranches of mortgage-backed securities rather than corporate debt — were a backwater until about 2001. Of the 283 CDOs issued in 1997–99, eight were ABS CDOs. Then corporate defaults in the 2000–2002 downturn made mortgage collateral look attractive by comparison, and the market went vertical: past $20 billion in 2001, and $307.7 billion in 2006 on SIFMA's numbers. By 2004 it was common for three-quarters or more of an ABS CDO's pool to be subprime residential mortgage securities.

Rating these fell to the CDO teams, who reused the ratings their ABS colleagues had already produced — the same division of labour that had always applied to corporate CDOs. And they needed an ABS correlation. Every route to estimating one was blocked: ABS did not trade in a way that yielded implied correlations, ABS defaults were too rare to estimate clustering from, and there was no tranched ABS index until the TABX in February 2007. So they used judgment, and the judgment they used was the number already in the machine:

• S&P took 0.3 for ABSs in the same sector, the same figure it used for corporations in the same industry, and 0.1 between sectors.
• Moody's baseline for U.S. subprime residential mortgage securities was 0.22, raised for factors such as closeness of vintage — by about 0.1 for same-vintage pairs — landing in practice around 0.3.
• Fitch used explicitly judgment-based figures of 0.3 to 0.55, with 0.55 apparently used for subprime RMBS. Fitch was also the agency being squeezed out: its share of CDO ratings fell from around 65% before 2004 to around 15% in 2006–7, while S&P and Moody's each rated 85% to 95% of all CDOs and investors typically wanted two ratings.

The stricter agency was the one losing the business. That is a Goodhart result without anyone having to be corrupt about it, and it is why goodharts-law-1975 is this entry's ancestor: once AAA became the target that determined which agency got hired, the correlation parameter stopped being a measure of anything and became the lever that produced the target. The descent is conceptual and not historical — nobody at S&P in 2001 was reading Goodhart.

What 0.3 bought is arithmetic. Take the BBB tranches — 3% of each mortgage bond — pool them, tranche the pool, and at a correlation of 0.3 the resulting "mezzanine ABS CDO" comes out 62% super-senior AAA and a further 14% AAA: three-quarters of a security built entirely from the near-bottom of the investment-grade scale, rated at the top of it. One of MacKenzie's interviewees put the sensitivity plainly: assuming 0.5 rather than 0.3 would have undermined the arbitrage, "leaving mezzanine ABS CDOs economically unviable." The entire product line rested on the difference between two numbers that nobody could measure.

The deeper mechanism, which is not the number

Here MacKenzie's finding diverges from the story most people carry, and it is the part of this entry with the most transfer value.

The choice of 0.3 was, in his words, the "chief proximate precondition" of the arbitrage. But the background precondition was structural: the ABS was evaluated first, by one group, and then the CDO built out of ABSs was evaluated separately, by another group, which took the first group's ratings as inputs.

Diversification is a real free lunch: pool enough assets and the idiosyncratic risk cancels, leaving only the systematic risk everything shares. Rating each mortgage bond already spent that lunch — the pool's geographic and borrower diversity was exactly what justified its AAA tranche. Rating the CDO then spent it again, treating a pool of already-diversified mortgage bonds as though it too had idiosyncratic risk left to cancel. It did not. What was left in a subprime ABS after its own diversification was almost purely systematic: exposure to a national fall in house prices, which packaging more of them together does nothing to reduce.

> In the two-step process, however, the lunch was frequently being eaten twice, > so to speak. > — MacKenzie, p. 1815

Nobody decided this. It fell out of an org chart. An interviewee at one agency reports that "communication between the ABS and CDO groups was very poor," and MacKenzie's counterfactual — what if one group had been made to model the merged loan pool end to end? — turns out to be something no one has been found to have done, mostly for computational reasons. When CDO specialists at one agency tried it in around 2006 "as a case of intellectual curiosity," calibrating Vasicek's model to the observed ratings of ABS tranches, the correlations they backed out were "far from the modest" values in use.

What the ratings were doing

None of this would matter if a rating were merely an opinion in public. It was not. The FCIC's own summary of why is the tightest statement of the mechanism this entry exists to name:

> We conclude the failures of credit rating agencies were essential cogs in the > wheel of financial destruction. … The mortgage-related securities at the heart > of the crisis could not have been marketed and sold without their seal of > approval. Investors relied on them, often blindly. In some cases, they were > obligated to use them, or regulatory capital standards were hinged on them. > This crisis could not have happened without the rating agencies. > — The Financial Crisis Inquiry Report, Conclusions, p. xxv (emphasis added)

Obligated to use them. Money-market fund eligibility, insurance capital requirements, bank capital charges and countless private investment mandates were written in terms of rating symbols. That is the institutional work. A pension trustee who thought the correlation assumption was nonsense could not act on that thought without breaching a mandate written in the vocabulary the assumption produced.

The volume the FCIC records:

> From 2000 to 2007, Moody's rated nearly 45,000 mortgage-related securities as > triple-A. This compares with six private-sector companies in the United States > that carried this coveted rating in early 2010. In 2006 alone, Moody's put its > triple-A stamp of approval on 30 mortgage-related securities every working day. > The results were disastrous: 83% of the mortgage securities rated triple-A that > year ultimately were downgraded.

Six American companies were good enough for AAA. Thirty mortgage securities a day were. And Moody's revenue from rating structured finance went from $199.2 million in 2000 to $886.7 million in 2006 — the incentive was not subtle and did not need to be.

The end came on a date. On 10 July 2007 Moody's cut its ratings on 399 subprime residential mortgage-backed securities covering $5.2 billion, and S&P said the same day it might cut $12.1 billion more. The instrument that could not be argued with had been arguing with reality for about eighteen months, and lost.

Why a reading would cite it

Cite this when a number produced by a model is doing institutional work that the number's inputs cannot support — and cite it for the specific test, not for the mood. The test has three parts, all of them drawn from the 2008 record:

1. Where did the parameter come from? Not "is it accurate" — often unknowable — but is it an estimate, a convention, or a value reverse-engineered to preserve the answers of whatever it replaced. 2. What has been keyed off the output? An opinion becomes unarguable when a rule, a mandate or a purchase order is written in its vocabulary. 3. Is anything downstream reusing the output without re-deriving it? This is the two-step, and it is the part people miss.

Three live occasions, in the ground this project's readings cover:

Compute thresholds as regulatory triggers. The EU AI Act presumes systemic risk for a general-purpose model trained above 10²⁵ floating-point operations (Article 51(2)), a rebuttable presumption the Commission may amend by delegated act under Article 51(3). The United States briefly had a 10²⁶ reporting threshold for dual-use foundation models under Executive Order 14110 of 30 October 2023, revoked with the order itself by Executive Order 14148 on 20 January 2025. These numbers are honest proxies chosen because compute is measurable before release and does not depend on subjective judgment — which is exactly the property that made a correlation coefficient attractive in November 2001. The 2008 case is not an argument that a threshold is bad. It is the evidence on what happens when a proxy acquires legal weight and the world it proxies for moves: the interesting question is not whether 10²⁵ is right but whether the mechanism for revising it moves as fast as the thing it is measuring, and who benefits from it not moving. Note the asymmetry that this entry warns about: S&P's 0.3 was, against Parisi's econometric estimate of 0.06 for pairs of U.S. residential mortgage pools in 1995–2002, arguably conservative. A defensible number can still be catastrophic once something is built on top of it.

Evaluations as premarket gates. On 18 August 2026 the FDA opened a public docket alongside a discussion paper on generative-AI medical devices, floating a competency model borrowed from physician licensing: nonclinical benchmarking of clinical knowledge, analytical ability, safety behaviour and communication, then clinical confirmation, then periodic retesting. Comments close 19 October 2026. This is a regulator proposing to key an approval decision to benchmark scores. The 2008 case says the question to ask of such a scheme is not "are the benchmarks good" but "what is the benchmark score substituting for, and can the substitution survive the thing it is measuring changing underneath it." Notably, the FDA paper makes the anti-two-step choice explicitly — it proposes to evaluate the finished device as clinicians actually use it rather than the foundation model underneath. MacKenzie's finding is the historical argument for why that choice is the load-bearing one, and it is worth citing precisely because the reasoning has nothing to do with medicine.

Inherited safety claims. The tightest structural analogue is not the formula. It is this: a frontier model is evaluated, and then fine-tunes, agent scaffolds, tool-connected deployments and downstream products inherit the evaluation without anyone re-deriving it for the composite. That is the two-step, exactly — an assessment made of a component, reused as an assessment of the system built out of components, where the property that justified the first assessment does not survive the composition. In 2008 the property was diversification. In an agent stack it is whatever the base-model evaluation actually established about a model that was not connected to a user's mail, calendar and payment credentials.

Cite it also when someone offers precision as a substitute for argument. This project's own instruments are built against this failure: the needle is a bare integer with no unit and no decimals, and bin/ethos-check.py refuses to distribute a reading that fakes precision. That rule exists because a number with a decimal point in it stops being read as a judgment, and once it stops being read as a judgment nobody asks whose it is. The 2008 record is the strongest available evidence for the rule, and it is external evidence, which is the only kind that counts here — the project's own output is not evidence for anything, including for its own design choices.

Where this entry does not reach. It is not evidence that AI will cause a financial crisis, and a reading that uses it that way is using a documented mechanism as a mood. It says nothing about whether any particular AI number is wrong. And it establishes a possible failure, not a rate: the base rate for how often model outputs that carry institutional weight go on to fail catastrophically is not in this entry and I have not seen it computed anywhere.

What it got right, and what it got wrong

Not required for interpretation, but this episode is more mythologised than almost anything else in the canon, so the claims should be graded like predictions. Four of them.

Claim: "the formula that killed Wall Street." Made by Wired's editors over Felix Salmon's cover story on 23 February 2009, which said the model had "devastated the global economy" and that "Li's Gaussian copula formula will go down in history as instrumental in causing the unfathomable losses that brought the world financial system to its knees." Due immediately; the historians got to it within five years.

Graded: partly right, wrong in the part everyone remembers. MacKenzie and Spears, who interviewed 114 market participants — 29 of them before the summer of 2007, which matters because it insulates part of their evidence from hindsight — conclude that "although Salmon's argument needs qualified, the Gaussian copula was implicated." A correlation assumption was indeed at the core, and Salmon was right to point at it. What is wrong is the personalisation and the causal shape. Li imported a function from actuarial science; the practices that mattered were organisational, the agencies' models were not the banks' models, and the copula in bank derivatives desks functioned largely as a quotation and transformation device rather than as a prediction of the future. The article won the American Statistical Association's Excellence in Statistical Reporting Award for 2010, which tells you how thoroughly the wrong shape travelled. This is the specific error a reading is most likely to repeat: reaching for the mathematics because the mathematics is the legible part, when the failure was in an org chart.

Claim: "the fragility of the assumption was not secret." This is the framing in canon/proposals.md, and it is the framing this entry was commissioned under.

Graded: right about 2005–2007, wrong about 2001–2004, and the distinction is the useful part. On the right side: David X. Li told Mark Whitehouse of the Wall Street Journal, in Slices of Risk: How a Formula Ignited Market That Burned Some Big Investors on 12 September 2005, that "very few people understand the essence of the model." That is the model's own author, in the largest financial newspaper in the country, two years before the collapse. And by 2007 the people inside were writing it down: on 5 April 2007 two S&P officials exchanged instant messages about a deal — "model def does not capture half the risk," "we should not be rating it," "we rate every deal. It could be structured by cows and we would rate it" — while an S&P email from December 2006 hoped "we are all wealthy and retired by the time this house of cards falters." Both were released by Henry Waxman's House Committee on Oversight and Government Reform at its hearing of 22 October 2008.

On the wrong side: none of that is about the 0.3. MacKenzie, who went looking, is explicit — "as far as I can tell, no one at the time foresaw, at least at all clearly, that the effects of the choice of 0.3 would in fact be far from conservative." The contemporaneous controversy over S&P's Evaluator was about the zero interindustry correlation, not the intrasectoral ABS figure, and against Parisi's 0.06 the 0.3 looked cautious. The honest version of the claim is therefore sharper and more uncomfortable: the people close to the deals knew the deals were bad, and nobody identified the parameter that made them possible. A reading that says "the fragility was obvious" is claiming a legibility the record does not support, and is thereby making the failure sound easier to avoid than it was.

Claim: the crisis was avoidable and the rating agencies were essential to it. Made by the FCIC majority, 27 January 2011.

Graded: the ratings finding survives; the report around it does not carry a consensus. The Commission split 6–4 along the party of appointment, and the dissents are substantial — Peter Wallison's blames federal housing policy, and the Hennessey/Holtz-Eakin/Thomas dissent argues the majority "is unbalanced and leads to incorrect conclusions about what caused the crisis," pointing at parallel failures in European systems with stricter regulation. But their own list of ten essential causes contains, as cause IV:

> Credit ratings and securitization. Failures in credit rating and > securitization transformed bad mortgages into toxic financial assets. … > Credit rating agencies erroneously rated mortgage-backed securities and their > derivatives as safe investments. Buyers failed to look behind the credit ratings > and do their own due diligence. > — Dissenting Statement of Hennessey, Holtz-Eakin and Thomas, p. 418

On a commission that agreed on almost nothing else, all ten commissioners recorded the ratings failure. That is unusually strong for a contested historical judgment, and it is the reason this entry can be written at all.

Claim, implicit in the reform: "remove the ratings from the rules and the problem goes away." Dodd-Frank section 939A, enacted July 2010, ordered every federal agency to strike references to credit ratings from its regulations and substitute its own creditworthiness standards.

Graded: done, slowly, and the underlying question was moved rather than answered. The SEC needed six rulemakings; five landed between 2011 and 2015 — including the removal of ratings from the money-market fund rule 2a-7 in September 2015 — and the last, on Regulation M, was not adopted until June 2023, after proposals in 2008 and 2011 that failed. Thirteen years to unwrite the references. And what replaced a rating is, in each case, some other standard of creditworthiness that some institution has to determine, which is the same problem wearing different clothes. The lesson a reading should take is not "don't use numbers in rules." It is that the number in the rule is where the judgment went to hide, and that removing it takes an order of magnitude longer than installing it.

Commonly misused as

Not required for interpretation, but this entry earns the section, because the 2008 story is invoked in AI argument constantly and almost always for something it does not establish.

Misused as: "the math was wrong, so distrust quantification." The most important thing MacKenzie establishes cuts the other way. His counterfactual — merge the underlying loan tapes from every constituent mortgage bond, run the loan-level models over the merged pool, then model the cash-flow consequences for the CDO — is more modelling, not less, and he concludes it would have been "unlikely to permit the CDO to have large AAA tranches." The failure was a shortfall of computation and an excess of institutional convenience, not an excess of mathematics. A reading that cites this entry to argue for replacing an evaluation with expert judgment has inverted it.

Misused as: "it was too complex for anyone to understand." The complexity alibi is popular and false here. The 0.3 was a single published number in a documented methodology. The two-step structure was visible on any org chart. The subprime ABS capital structure fits in a diagram with five boxes. What defeated scrutiny was not complexity but division: no one person's job included looking at both steps.

Misused as: "greed did it." Available, and underdetermined by the evidence. The strategic reading — that 0.3 was chosen because the fees required it — is the natural one, and MacKenzie explicitly raises it and then declines to assert it, because the same value has an innocent genealogy (consistency with notching) and was defensible against the econometrics of the day. The record supports "an incentive structure that made a convenient assumption very hard to revisit"; it does not, at the level of the parameter, support "they knew and did it anyway." A grade that reaches for the stronger claim because it is more satisfying is exactly the failure mode README.md rule 7 describes — a judgment going quietly hard instead of quietly soft, invisible either way.

Misused as: a warrant for predicting an AI-driven financial crash. This entry contains no forecast. It is a mechanism with one documented instance. Using it to score a needle would be using history as evidence, which the canon forbids for good reason.

And the misuse specific to this project: treating the entry as licence to distrust the needle. The needle is a judgment, recorded and labelled as judgment, with no unit and no decimal. That is the opposite of what happened in 2008, where a judgment was laundered into something that looked like a measurement. The correct use of this entry against this project is narrower and sharper: watch for the day something starts keying off the needle — a rule, a habit, a second reader's decision — because that is the moment the number begins doing institutional work, and this entry is about what happens next.

Sources

Read directly, as rendered page images.

• **Donald MacKenzie, "The Credit Crisis as a Problem in the Sociology of Knowledge," American Journal of Sociology 116(6) (2011): 1778–1841 — the author's PDF at sps.ed.ac.uk/sites/default/files/assets/pdf/CrisisRevised.pdf, read as page images covering journal pages 1794–1817. This is the backbone of the entry and the source for: the 81/11/4/3/1 subprime ABS structure and the 62%/14% mezzanine ABS CDO structure (both his figures 3 and 4, after Lucas 2007); "almost no explicit modeling of statistical dependence among mortgage defaults" and the "conditional independence" quotation; the release dates of CDO Evaluator (November 2001), Vector (July 2003) and CDOROM (May 2004); "not a proper correlation method"; "the assumption of low levels of correlation was at the very core of the rationale for CDOs"; the 0.3 intra-industry value and the "partly to maintain consistency with the previous notching scheme" quotation; the zero interindustry and 0.1 intersectoral ABS figures (his cite: Bergman 2001); Moody's 0.22 baseline and vintage adjustment (Toutain et al. 2005); Fitch's 0.3–0.55 and 0.55 (Whetten and Adelson 2005); the 85–95% and 65%→15% market-share figures (his cite: Barnett-Hart 2009, fig. 8); the interviewee on 0.5 leaving mezzanine ABS CDOs "economically unviable"; Parisi's 0.06 for 1995–2002; "no one at the time foresaw, at least at all clearly"; ABS CDO issuance of $20bn in 2001 and $307.7bn in 2006 (his cite: SIFMA) and eight of 283 CDOs in 1997–99; the three-quarters-subprime pools by 2004; "the lunch was frequently being eaten twice"; "communication between the ABS and CDO groups was very poor"; the merged-pool counterfactual and the 2006 "intellectual curiosity" exercise; and the Moody's February 2001 line "we often hear that no ABS security has ever defaulted." Limits:** I read 24 of the article's 64 pages. Its opening framing and its closing sections on the ABX and on the sociology of knowledge I did not read, so nothing above is attributed to them.
• **Donald MacKenzie and Taylor Spears, "'The Formula That Killed Wall Street': The Gaussian Copula and Modelling Practices in Investment Banking," Social Studies of Science 44(3) (2014): 393–417 — the 2013 author's manuscript at sps.ed.ac.uk/sites/default/files/assets/pdf/Formula12.pdf, read as page images, manuscript pages 1–11. Source for the verbatim Salmon quotations ("devastated the global economy"; "will go down in history as instrumental in causing the unfathomable losses"), for the interview counts (114 total, 29 with quants, 29 conducted before summer 2007), for Vasicek as developer of the first Gaussian copula model in finance, and for the verdict "although Salmon's argument needs qualified, the Gaussian copula was implicated." Limits:** I did not read the later sections on base correlation and no-arbitrage modelling, so the characterisation of the copula as a quotation and transformation device rests on their abstract and on MacKenzie (2011), not on those sections.
• ***The Financial Crisis Inquiry Report*, Conclusions of the Financial Crisis Inquiry Commission, 27 January 2011** — the PDF at fcic-static.law.stanford.edu/cdn_media/fcic-reports/fcic_final_report_conclusions.pdf, read as page images, pages xx–xxvi. Source for the "essential cogs in the wheel of financial destruction" passage in full, for "obligated to use them, or regulatory capital standards were hinged on them," for the 45,000 / six companies / 30-per-working-day / 83% figures, and for the list of causes behind the Moody's breakdown ("the flawed computer models, the pressure from financial firms that paid for the ratings, the relentless drive for market share").
• Dissenting Statement of Commissioners Keith Hennessey, Douglas Holtz-Eakin and Bill Thomas, in the same report — the PDF at fcic-static.law.stanford.edu/cdn_media/fcic-reports/fcic_final_report_hennessey_holtz-eakin_thomas_dissent.pdf, read as page images, pages 416–421. Source for the verbatim text of essential cause IV, "Credit ratings and securitization," and for "the majority's report is unbalanced and leads to incorrect conclusions about what caused the crisis."

Established by search against primaries, without reading the full document. For each of these I can vouch for the fact and the citation and not for having read the source end to end.

• **David X. Li, "On Default Correlation: A Copula Function Approach," Journal of Fixed Income 9(4) (March 2000): 43–54**, earlier RiskMetrics Group working paper 99-07 (1999) — publication details only; I did not read the paper.
• **Mark Whitehouse, "Slices of Risk: How a Formula Ignited Market That Burned Some Big Investors," Wall Street Journal, 12 September 2005** — the Li quotation "very few people understand the essence of the model." Paywalled; the quotation and date are corroborated across multiple independent accounts, and I did not read the article.
• **Felix Salmon, "Recipe for Disaster: The Formula That Killed Wall Street," Wired 17.03, published 23 February 2009** — wired.com is not fetchable from this machine. Every quotation from it above is taken from MacKenzie and Spears, who quote it directly. The 2010 American Statistical Association award is from search summary.
• **Joshua Coval, Jakub Jurek and Erik Stafford, "The Economics of Structured Finance," Journal of Economic Perspectives 23(1) (2009): 3–25** — read via a summarising fetch of the AEA landing page for the citation and the abstract's "extreme fragility of their ratings to modest imprecision in evaluating underlying risks." Their systematic-risk argument is characterised above from MacKenzie's footnote 45, not from their text.
• House Committee on Oversight and Government Reform hearing, "Credit Rating Agencies and the Financial Crisis," 22 October 2008 — the "structured by cows" instant messages of 5 April 2007 and the December 2006 "house of cards" email. Taken from contemporaneous news accounts of the documents Chairman Waxman released, not from the committee's exhibit PDFs.
• Moody's structured finance revenue, $199.2m (2000) and $886.7m (2006) — from Moody's Corporation SEC filings via search summary; sec.gov returned 403 to direct fetch from here.
• Moody's downgrade of 399 subprime RMBS covering $5.2bn, 10 July 2007, with S&P signalling action on $12.1bn the same day — from contemporaneous reporting and the Moody's announcement archived by the FCIC.
• Dodd-Frank section 939A and the SEC's six implementing rulemakings, 2011–2015 and the Regulation M rule of June 2023 — from SEC materials and law firm summaries via search.
• EU AI Act Articles 51(2) and 51(3); Executive Order 14110 of 30 October 2023 and its 10²⁶ reporting threshold; Executive Order 14148 of 20 January 2025, which revoked it — from the instruments and from summaries via search.
• Fred Benenson's coinage of "mathwashing," June 2016 (Technical.ly Brooklyn interview) and Andy Baio's "AI data laundering," September 2022 (Waxy) — from search summary.
• FDA discussion paper and public docket on generative-AI medical devices, 18 August 2026, comments closing 19 October 2026 — from trade reporting; the FDA's own page was not reachable from here, the same limitation the 20 August reading recorded.

What I could not verify, and left out.

• The Levin–Coburn report itself. Wall Street and the Financial Crisis: Anatomy of a Financial Collapse was issued 13 April 2011, following four hearings in April 2010 of which the credit-rating-agency hearing was 23 April 2010. Search results disagreed on the report's year — one summary gave April 2010 — and I did not read the report or its exhibits, so nothing above is sourced to it beyond the hearing dates.
• Moody's profitability. The frequently repeated claim that Moody's had the highest profit margin in the S&P 500 for several consecutive years is not used above, because I could not source it to a filing or to the FCIC text.
• The FCIC's own chapter on the rating agencies (chapter 11) and its chapter on the CDO machine (chapter 8). I read the Conclusions only. Everything attributed to the FCIC above is from pages xx–xxvi.
• Coval, Jurek and Stafford's companion paper on the systematic-risk properties of these tranches exists and is referenced in the literature; I could not confirm its title, journal and pages this session, so it is not cited.

On the boundary. This file names goodharts-law-1975 and content-farms-2016 as entries that exist in canon/, and ltcm-1998 as an id that is proposed and not yet written — canon/proposals.md lists it directly below this entry, and the distinction the proposal draws is worth preserving until someone writes it: LTCM was sophisticated users wrong about the tails; this was a number manufactured because the number was the product. No id is invented into the header. It refers to README.md, bin/ethos-check.py and the reading of 20 August 2026 solely to establish citation occasions and boundaries, in the manner asilomar-1975 and doomsday-clock-1947 established theirs; all of those are the project's own output and are not evidence, here or anywhere. It deposits nothing in history/, touches no other entry, and places no needle, no score and no landmark.