Governance

Global Delivery And Resourcing Standard

Table Of Contents

1. Scope And Applicability
2. Corporate Role And Responsibilities
3. Delivery Footprint And Resourcing Model
4. Screening, Eligibility, And Training
5. Information Security And Data Protection
6. Data Handling, Retention, And Deletion
7. Use Of Tools And Automation
8. KYC, AML, Sanctions, And Export Controls
9. Subcontractor Governance And Audit Rights
10. Commercial Terms And Pricing Transparency
11. Intellectual Property And Licensing
12. Insurance And Liability
13. Cross-Border Staffing And Employment Compliance
14. Communications Protocol
15. Change Management And Notices
16. Incident Response And Business Continuity
17. Delivery Bench And Qualifications
18. Sub-Processor Register
19. FAQ
20. Definitions And Glossary
21. Legal Disclaimer

Scope And Applicability

This Standard applies to all Financely mandates and to all personnel and subcontractors who process client data or contribute to deliverables. It covers advisory and arrangement services for trade instruments, project and real estate financings, and acquisition funding. It does not authorize regulated activities that require a banking or broker-dealer license. Such activities are performed only by regulated counterparties under their own permissions.

Corporate Role And Responsibilities

• Role. Financely acts as advisor and arranger. Issuance or lending is performed by regulated institutions.
• Client Portal. The portal is the single channel for documents, Q&A, status, and decisions. Email is used for notifications only.
• Privacy Roles. The client is Controller. Financely is Processor. Sub-processors are disclosed in the Register.

Delivery Footprint And Resourcing Model

Work is executed through a mix of employees, independent contractors, and approved specialist firms. Locations include onshore, nearshore, and offshore hubs with time-zone coverage and English as the working language. Key-person commitments are defined in the mandate. Substitution and backfill timelines are stated in writing.

Screening, Eligibility, And Training

• Identity and right-to-work verification, reference checks, and conflicts screening for all staff and subcontractors.
• Background checks calibrated to jurisdiction and role sensitivity.
• Mandatory onboarding on confidentiality, data protection, information security, and sanctions compliance, refreshed annually.

Information Security And Data Protection

Controls align to industry frameworks such as ISO 27001 and SOC 2. Security schedules are attached to the Data Processing Agreement. Core measures are listed below.

Data Handling, Retention, And Deletion

Categories processed may include corporate identity data, KYC files, financial statements, contracts, trade documents, and limited contact data for counterparty teams. Sensitive personal data is avoided. Retention is set by mandate type and law. Deletion or anonymization is executed at mandate close or on request where legally permitted. Backups follow the same retention policy.

Use Of Tools And Automation

• Deal rooms, KYC screening utilities, collaboration, and modeling tools are listed in the Sub-processor Register.
• Automated extraction or screening is always subject to human review before external use.
• Client materials are not used to train public models. Access to any generative tooling is gated and logged.

KYC, AML, Sanctions, And Export Controls

All mandates are conditioned on KYC and AML results, sanctions screening, and issuer or lender approvals. If export-controlled information is present, only eligible personnel may access it. Financely may pause or terminate work where screenings fail or where legal constraints arise.

Subcontractor Governance And Audit Rights

• Material subcontractors require prior client consent unless pre-approved in the mandate.
• Contractual flow-down of confidentiality, security, privacy, and sanctions obligations is mandatory.
• Right to audit on security and privacy, exercised with reasonable notice and scope.
• Notice of material changes to the Sub-processor Register with a right to object on reasonable grounds.

Commercial Terms And Pricing Transparency

Financely does not operate on pay-after-delivery or escrow-only expectations.

Intellectual Property And Licensing

• Client owns deliverables specified in the mandate. Financely retains pre-existing templates and know-how.
• Third-party and open-source components are disclosed with applicable licenses.
• Non-infringement and indemnity boundaries are defined in the engagement letter.

Insurance And Liability

Cross-Border Staffing And Employment Compliance

• Worker classification complies with local law. Financely is responsible for wages, taxes, and benefits of its personnel.
• Co-employment risk is managed through supervision boundaries and statement of work controls.
• Immigration and right-to-work compliance are required for onsite work.
• Where applicable, local rules such as IR35 or agency worker protections are observed.

Communications Protocol

All documents, approvals, and formal Q&A are maintained in the client portal. Weekly status cadence is agreed at kick-off. No side channels for binding decisions.

Change Management And Notices

• Change-log maintained in the portal with version, date, and owner.
• Sub-vendor changes are notified before use where material. Client may object on reasonable grounds.
• Scope changes require written approval and may affect timetable and fees.

Incident Response And Business Continuity

Financely maintains incident response runbooks with named owners and decision trees. Material incidents are communicated through the portal with timelines and remediation tasks. Business continuity plans include remote execution capability, backup communications, and recovery point and time objectives suitable for advisory services.

Delivery Bench And Qualifications

Sub-Processor Register

A named vendor list with jurisdictions is provided under NDA and updated in the portal.

FAQ

Do you disclose where work is performed
Yes. Onshore, nearshore, and offshore locations are disclosed with time-zone coverage in the mandate. Material changes are notified in advance.

Can client data be stored outside the client’s country
Yes where lawful safeguards exist and are documented. Storage locations and transfer mechanisms are disclosed in the Data Processing Agreement.

Will subcontractors access confidential information
Only where required and approved. All subcontractors sign binding confidentiality and follow the same security and privacy obligations through flow-down terms.

Are you certified under ISO 27001 or SOC 2
Controls align to these frameworks. Certification status and supporting evidence can be shared under NDA.

Who owns the work product
The client owns deliverables defined in the mandate. Financely retains pre-existing templates and know-how.

What happens if screening fails
Financely may pause or terminate the mandate. No party is obliged to proceed where legal or sanctions risks are present.

Do you guarantee funding outcomes
No. Outcomes depend on credit quality, structure, documentation, and market appetite. Engagements focus on defensible transactions with clear counterparties.

How do you handle incidents
Incidents follow the response plan with containment, notification, remediation, and post-incident review. Timelines meet statutory and contractual requirements.

Definitions And Glossary

Controller. The entity that determines purposes and means of processing personal data.

Processor. The entity that processes personal data on behalf of the Controller.

Data Processing Agreement. Contract that sets privacy roles, security controls, and transfer safeguards.

Sub-processor. Third party engaged by the Processor to process personal data.

KYC And AML. Know Your Customer and Anti-Money Laundering screenings required before onboarding.

Sanctions Screening. Checks against lists issued by authorities to prevent prohibited dealings.

Right-to-Work. Verification that personnel are legally permitted to work in the relevant country.

Incident. A security or privacy event that may affect confidentiality, integrity, or availability of data.

Business Continuity. Capability to continue critical functions during disruption.

Intercreditor. Agreement between finance parties that sets ranking and enforcement rules.

Blocked Account. Bank account controlled under an account control agreement.

Waterfall. Ordered application of cash to fees, interest, principal, reserves, and distributions.

Legal Disclaimer

Financely is a capital advisory. The firm is not a bank and not a broker-dealer. Services are provided subject to KYC and AML, sanctions screening, credit approvals, documentation, and applicable law. This Standard forms part of the engagement governance and may be updated in the portal. Conflicts are resolved by the signed mandate and applicable local law.