Purpose
Coordinate enterprise risk oversight of vendors, service providers, banks, custodians, liquidity providers, VASPs and other material counterparties and dependencies.
PDF-Derived Operational Detail
Bitkaya manages risk arising from vendors, service providers, liquidity providers, banks, custodians, VASPs, and other relevant counterparties through risk-based due diligence, contractual controls, performance monitoring, and escalation procedures.
Due diligence areas include: legal status and authority; reputation and financial soundness; control environment and resilience; regulatory and supervisory standing; sanctions exposure; data protection and confidentiality implications; subcontracting or sub-processing arrangements; dependency concentration; and exit feasibility.
For VASP relationships, KYV measures must be applied on a documented risk basis and aligned with Bitkaya’s AML/CTF/CPF control framework.
Business continuity support. The RMF supports continuity by ensuring that material disruptions are assessed not only as operational events, but also as risk, governance, client protection, and regulatory matters. Risk management supports business continuity by ensuring that: critical functions are identified and prioritized; dependencies and single points of failure are understood; resilience controls are tested; recovery assumptions are documented; crisis decision-making is supported by escalation criteria; and material incidents are assessed for legal, client, financial crime, safeguarding, and regulatory consequences.
Proportionality for third parties. Outsourcing is used strategically (e.g., cybersecurity, audit, analytics) with formal vendor oversight replacing internal redundancy. Vendor due diligence follows a tiered risk approach proportionate to the criticality of the service.
Steps
- Identify the relationship, service, dependency, data, assets, jurisdictions and criticality.
- Perform risk-based due diligence covering: legal status and authority; reputation and financial soundness; control environment and resilience; regulatory and supervisory standing; sanctions exposure; data protection and confidentiality implications; subcontracting or sub-processing arrangements; dependency concentration; and exit feasibility.
- Apply KYV measures to VASP relationships on a documented risk basis, aligned with Bitkaya’s AML/CTF/CPF control framework.
- Define contractual, security, audit, continuity, reporting, service-level and exit safeguards.
- Record approved relationships in the applicable register.
- Monitor performance, financial and regulatory standing, incidents, control evidence, concentration and subcontracting.
- Test continuity, substitution and exit assumptions proportionately. Ensure critical functions are identified and prioritized, dependencies and single points of failure are understood, resilience controls are tested, and recovery assumptions are documented.
- Escalate deterioration, breaches, outages or unacceptable residual risk. Support crisis decision-making with escalation criteria and assess material incidents for legal, client, financial crime, safeguarding, and regulatory consequences.
- Coordinate remediation, restriction, replacement or termination with the detailed outsourcing, AML, IT and continuity processes.
Exceptions and Escalation
This procedure does not replace detailed outsourcing approval or CBCS notification requirements. Material relationships shall not proceed without required due diligence, contract, approval and exit feasibility.
Records
- Criticality and risk assessment
- Due diligence and KYV evidence
- Contract and approval record
- Monitoring and resilience evidence
- Exit, escalation and remediation records
Relationships
- Policy: POL-RMF-001 Risk Management Framework Manual
- Process: PRC-GRO-001 Governance Risk and Outsourcing
- Control: CTRL-RMF-007 Ensure Third Party Counterparty and Resilience Risks Are Controlled
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: before engagement, ongoing and annual
History
- 2026-07-26: Created from sections 9 and 10 of the approved RMF.