Policy, Program and Procedures

Hello, 

Our Bank is looking to update our procedures and policy to specifically address due diligence on offshore/foreign-based vendors. Wondering if anyone would be willing to describe their assessment process for these types of vendors and share how the policy addresses the use of foreign-based vendors.

Hi

Given that you mention that you are a bank, one of the things that we had to consider was where we were willing to have our data reside. For those of us in Canada, and presumably for companies in other countries, there are restrictions on where data can reside.

The next thing we evaluated was whether the proposed jurisdiction was a jurisdiction we had already decided we were comfortable with (e.g. India). If it was a new jurisdiction, we did a thorough evaluation as to whether the proposed jurisdiction had similar laws that were enforceable by the courts. For example, if country had a history of being able to bribe the courts then we wouldn't do business with companies located in that jurisdiction.