Third-Party Risk Management Policy

Our Approach to Third-Party Risk

Unicorn Currencies relies on a carefully selected network of partners, vendors, and service providers to deliver our services. We recognize that third-party relationships introduce risks that must be identified, assessed, and managed throughout the relationship lifecycle.

This policy establishes our framework for third-party risk management, ensuring that partners meet our standards for regulatory compliance, security, operational resilience, and ethical conduct.

Scope

This policy applies to all third-party relationships including:

• Banking Partners: Correspondent banks, safeguarding banks, payment networks
• Payment Service Providers: FCA-authorized EMIs and PIs for UK/EU payments
• Technology Vendors: Cloud infrastructure, software, identity verification
• Professional Services: Legal, audit, compliance consultants
• Outsourcing Arrangements: Any functions performed by third parties

Due Diligence Framework

Initial Due Diligence

Before engaging any third party, we assess:

• Regulatory Status: Licenses, registrations, regulatory history
• Financial Stability: Financial statements, credit ratings, ownership
• Compliance Posture: AML/CTF controls, sanctions compliance, ABC policies
• Security Practices: Information security, certifications (SOC 2, ISO 27001)
• Operational Resilience: Business continuity, disaster recovery
• Reputation: Adverse media, regulatory actions, litigation

Risk Classification

Third parties are classified based on criticality and risk:

• Critical: Banking partners, payment processors, cloud infrastructure
• High: Identity verification, sanctions screening providers
• Medium: Professional services, non-critical software
• Low: Office supplies, non-sensitive services

Due diligence depth and ongoing monitoring frequency scale with risk classification.

Contractual Protections

All third-party contracts include:

• Compliance Obligations: AML/CTF, sanctions, data protection requirements
• Audit Rights: Right to audit or request third-party audit reports
• Data Protection: GDPR/PIPEDA-compliant data processing agreements
• Security Requirements: Minimum security standards, incident notification
• Business Continuity: Recovery time objectives, disaster recovery testing
• Termination Rights: Exit provisions, data return/destruction
• Indemnification: Liability for breaches and non-compliance

Ongoing Monitoring

We monitor third-party relationships through:

• Periodic Reviews: Annual for critical vendors, biennial for others
• Performance Monitoring: SLA compliance, incident tracking
• Adverse Media Screening: Continuous monitoring for regulatory/reputational issues
• Reassessment Triggers: Regulatory changes, security incidents, ownership changes
• Exit Planning: Contingency plans for critical vendor failure

Key Questions