Fintech, blockchain, and crypto companies are facing various risks. It is crucial to implement corporate policies that would help to mitigate risks. Some corporate policies are necessary by imperative laws (for example, for licensed entities AML, KYC policies are mandatory). Other policies are not mandatory by laws, but they can help you to protect your business (for example, the Risk management policy outlines steps that company management should do to prevent and mitigate risks, the Intellectual property policy protects your technical solution from copying, etc.)
The Sino Fintech team drafts complex corporate policies for different jurisdictions across Asia. We consider the applicable law of the jurisdiction where your company is incorporated, the jurisdiction of your permanent places of business, and the jurisdiction of the physical location of your end customers (when the policy is connected with customer relations).
Here are some of the key corporate policies that fintech, blockchain, and crypto businesses should consider implementing:
Anti-Money Laundering (AML) Policy: Fintech and crypto companies must implement AML policies to prevent their platforms from being used for money laundering or terrorist financing. The AML policy should outline procedures for customer due diligence, transaction monitoring, and reporting suspicious activities.
Know Your Customer (KYC) and Know Your Business (KYB) Policy: Fintech and crypto companies should implement a KYC and KYB policy to verify the identity of their customers and ensure they are not engaging in illegal activities. The policy should specify the types of documents required for identification, the procedures for verification, and the frequency of updates. The Know Your Transaction (KYT) Policy should also be in force if the business nature is connected with transaction processing.
Privacy Policy: Fintech and crypto companies should have a privacy policy outlining how they collect, use, and disclose their customers' personal data. The Privacy policy should specify the purpose of data collection, the types of data collected, and the measures taken to protect customer data. It is necessary to understand where your business can store the end customers’ data in accordance with the rules of their country of citizenship and/or country of residence.
Chinese PIPL (Personal Information Protection Law) determines "sensitive data'' similar to the European GDPR and even goes slightly further, classing sensitive data as any information which may cause material harm to an individual if it's leaked or illegally used. Opposite the European GDPR that applies to the data protection of all EU citizens, Chinese PIPL chooses the territorial scope of data protection. Chinese PIPL applies to:
- The handling of personal information within China's borders;
- Any handling of personal data outside China if it's related to selling goods or services to people within China.
Those details can influence the process of how one business treats the sensitive data of its different users. So, it is extremely important for a company to outline the guideline in the Privacy Policy.
Information Security Policy: Fintech and crypto companies must implement a comprehensive information security policy to protect their platforms from cyber-attacks and data breaches. The policy should outline procedures for access control, encryption, data backup, and incident response. If any technical certifications are required (for example, PCI DSS certification for payment processing), it should be mentioned in the Information Security Policy.
Code of Conduct and Ethics: Fintech and crypto companies should have a code of conduct and ethics that define the expected behaviour of their employees and the consequences of violating company policies. The policy should outline the principles of honesty, integrity, and transparency principles that govern the company's operations.
Risk Management Policy: Fintech and crypto companies should implement a risk management policy to identify, assess, and manage risks associated with their business. The policy should outline risk assessment, mitigation, and monitoring procedures.
Intellectual Property Policy: When a technological fintech or blockchain company develops new technologies, it should protect this technology from third-party use. Intellectual Property Policy should outline the process to protect know-how, patent inventions, and deal with the employees and independent contractors that create innovations for the company.
Token Sales Policy: Whether a start-up initiates crowdfunding and sells tokens, individuals from different jurisdictions can buy tokens by using their cryptocurrencies. Different rules should apply depending on the jurisdiction of citizenship and residence of the token supply. Before token sales start, it is essential to draft a Token Sales Policy and mention in it restricted jurisdictions and rules for token buyers. Depending on the legal nature of your token, you might have different regulations for qualified investors.
The Sino Fintech team is ready to draft various corporate policies that your business requires to minimize risks.