Governance
Global Delivery And Resourcing Standard
This Standard sets out how Financely plans, staffs, supervises, and safeguards client work across Trade Finance, Project Finance, Commercial Real Estate, and M&A advisory.
It defines roles, delivery footprint, subcontractor governance, information security, data protection, and commercial terms from engagement through close.
The objective is consistent execution with clear accountability, documented controls, and auditable records.
Scope And Applicability
This Standard applies to all Financely mandates and to all personnel and subcontractors who process client data or contribute to deliverables.
It covers advisory and arrangement services for trade instruments, project and real estate financings, and acquisition funding.
It does not authorize regulated activities that require a banking license, broker-dealer registration, or investment adviser status.
Any such activities are performed only by regulated counterparties under their own permissions and documentation.
Corporate Role And Responsibilities
- Role:
Financely acts as advisor and arranger. Issuance, lending, underwriting approvals, and regulated placement activity are performed by regulated institutions.
- Client Portal:
The portal is the primary channel for documents, Q&A, approvals, status, and decisions. Email is used for notifications and scheduling.
- Privacy Roles:
The client is the Controller. Financely is the Processor. Sub-processors are disclosed in the Sub-Processor Register.
Delivery Footprint And Resourcing Model
Work is executed through a mix of employees, independent contractors, and approved specialist firms.
Delivery can be onshore, nearshore, or offshore to provide time-zone coverage, with English as the working language.
Key-person commitments are documented in the mandate. Substitution and backfill expectations are stated in writing.
Resourcing Pyramid
- Engagement Lead and Underwriting Lead
- Documentation Counsel and Compliance
- Analysts, Modelers, and Diligence Specialists
Supervision
All personnel operate under Financely supervision. Clients do not supervise or direct subcontractors. Work product is reviewed before external use.
Working Hours
Coverage windows are agreed at kick-off. Escalation rules and incident contacts are recorded in the portal.
Screening, Eligibility, And Training
- Identity and right-to-work verification, reference checks, and conflicts screening for personnel and subcontractors.
- Background checks calibrated to jurisdiction and role sensitivity.
- Mandatory onboarding on confidentiality, data protection, information security, and sanctions compliance, refreshed at least annually.
Information Security And Data Protection
Controls are designed to align with common industry frameworks (for example, ISO 27001 and SOC 2 principles).
Security schedules are attached to the Data Processing Agreement where applicable.
Security Controls
- Role-based access, MFA, least privilege, periodic access recertification.
- Encryption in transit and at rest, with controlled key management.
- Device compliance, endpoint protection, and disk encryption.
- Change management and secure lifecycle controls for portal components.
- Third-party risk review for sub-processors and specialist firms.
Privacy Controls
- Data minimization and purpose limitation controls.
- International transfer safeguards and storage location disclosures.
- Breach workflow with contractual notification timelines.
- Data Subject Request handling within agreed timelines.
- Retention and deletion schedules by data class.
Data Handling, Retention, And Deletion
Processed categories may include corporate identity data, KYC files, financial statements, contracts, trade documents, and contact data for deal teams.
Sensitive personal data is avoided where feasible. Retention is set by mandate type and applicable law.
Deletion or anonymization is executed at mandate close or on request where legally permitted. Backups follow the same retention logic.
- Deal rooms, screening tools, collaboration tooling, and modeling environments are disclosed in the Sub-Processor Register.
- Automated extraction or screening is subject to human review before external use.
- Client materials are not used to train public models. Access to any generative tooling is gated and logged where enabled.
KYC, AML, Sanctions, And Export Controls
All mandates are conditioned on KYC and AML results, sanctions screening, and issuer or lender approvals.
If export-controlled information is present, access is restricted to eligible personnel.
Financely may pause or terminate work where screenings fail or where legal constraints prevent continuation.
Subcontractor Governance And Audit Rights
- Material subcontractors require prior client consent unless pre-approved in the mandate.
- Contractual flow-down of confidentiality, security, privacy, and sanctions obligations is required.
- Audit rights on security and privacy can be exercised with reasonable notice and scope.
- Material changes to the Sub-Processor Register are notified with a right to object on reasonable grounds.
Commercial Terms And Pricing Transparency
Financely does not operate on pay-after-delivery expectations for underwriting and structuring work.
Intellectual Property And Licensing
- Clients own deliverables specified in the mandate. Financely retains pre-existing templates, methodologies, and know-how.
- Third-party and open-source components are disclosed with applicable license terms.
- Non-infringement and indemnity boundaries are defined in the engagement letter.
Insurance And Liability
Insurance Classes
- Professional liability
- Cyber and privacy liability
- Employers’ liability and workers’ compensation
Certificates
Certificates of insurance are provided on request. Minimum limits can be stated in the mandate where required.
Liability
Liability caps and carve-outs are set in the engagement letter. Fraud and willful misconduct are excluded from any cap.
Cross-Border Staffing And Employment Compliance
- Worker classification follows applicable local law. Financely is responsible for wages, taxes, and benefits of its personnel.
- Co-employment risk is managed through supervision boundaries and statement of work controls.
- Immigration and right-to-work compliance is required for onsite work.
- Where applicable, local rules such as IR35 and agency worker protections are observed.
Communications Protocol
Documents, approvals, and formal Q&A are maintained in the client portal. A weekly cadence can be agreed at kick-off. Binding decisions are not taken through side channels.
Change Management And Notices
- Change logs are maintained in the portal with version, date, and owner.
- Sub-vendor changes are notified before use where material. Clients may object on reasonable grounds.
- Scope changes require written approval and may affect timetable and fees.
Incident Response And Business Continuity
Financely maintains incident response procedures with named owners and decision trees.
Material incidents are communicated through the portal with remediation tasks and timelines.
Business continuity planning includes remote execution capability, backup communications, and recovery objectives suitable for advisory services.
Delivery Bench And Qualifications
Core Capabilities
- Trade instrument structuring, LC and SBLC documentation support, structured trade facilities
- Project and commercial real estate underwriting, construction monitoring coordination, cost review
- M&A diligence coordination and transaction documentation support
- Receivables programs and securitization readiness support with governance workflows
Specialist Network Pre-vetted
The specialist bench can include former bank trade heads, documentation counsel, construction engineers, trustees, and experienced analysts.
Specialists are engaged through Financely under consistent governance and quality controls.
Sub-Processor Register
A named vendor list with jurisdictions can be provided under NDA and maintained in the portal.
FAQ
Do you disclose where work is performed?
Yes. Onshore, nearshore, and offshore locations are disclosed with time-zone coverage in the mandate. Material changes are notified in advance.
Can client data be stored outside the client’s country?
Yes, where lawful safeguards exist and are documented. Storage locations and transfer mechanisms are disclosed in the Data Processing Agreement.
Will subcontractors access confidential information?
Only where required and approved. Subcontractors are bound by confidentiality and must follow the same security and privacy obligations through flow-down terms.
Are you certified under ISO 27001 or SOC 2?
Controls are designed to align with these frameworks. Certification status and supporting evidence can be shared under NDA where available.
Who owns the work product?
The client owns deliverables defined in the mandate. Financely retains pre-existing templates, methodologies, and know-how.
What happens if screening fails?
Financely may pause or terminate the mandate. No party is obliged to proceed where legal, sanctions, or compliance risks are present.
Do you guarantee funding outcomes?
No. Outcomes depend on credit quality, structure, documentation, and market appetite. Engagements focus on defensible transactions with identifiable counterparties.
How do you handle incidents?
Incidents follow the response plan with containment, notification, remediation, and post-incident review. Timelines meet statutory and contractual requirements.
Definitions And Glossary
Controller:
The entity that determines the purposes and means of processing personal data.
Processor:
The entity that processes personal data on behalf of the Controller.
Data Processing Agreement:
The contract setting privacy roles, security controls, and transfer safeguards.
Sub-processor:
A third party engaged by the Processor to process personal data.
KYC And AML:
Know Your Customer and Anti-Money Laundering screenings required before onboarding.
Sanctions Screening:
Screening against lists issued by authorities to prevent prohibited dealings.
Right-to-Work:
Verification that personnel are legally permitted to work in the relevant country.
Incident:
A security or privacy event that may affect confidentiality, integrity, or availability of data.
Business Continuity:
Capability to continue critical functions during disruption.
Intercreditor:
Agreement between finance parties setting ranking and enforcement rules.
Blocked Account:
A bank account controlled under an account control agreement.
Waterfall:
Ordered application of cash to fees, interest, principal, reserves, and distributions.
Legal Disclaimer
Financely is a capital advisory firm. Financely is not a bank and not a broker-dealer.
Services are provided subject to KYC and AML, sanctions screening, credit approvals, documentation, and applicable law.
This Standard forms part of engagement governance and may be updated in the portal. Conflicts are governed by the signed mandate and applicable law.