Vendor compliance monitoring

Compliance doesn't stop at onboarding. Expired insurance, revoked licences, or newly-sanctioned entities create liability — monitoring is continuous.

Expiry watch

Every document with an expiry date is watched:

• Insurance certificates.
• IATA / FIATA / CMR registration.
• Customs broker licences (per country).
• AEO / C-TPAT certifications.
• ADR / hazmat licences.
• ISO / SOC 2 audits (for IT vendors).

Alerts at 60 / 30 / 7 days. Block transactions 7 days after expiry unless grace period approved.

Sanctions re-screening

Daily re-run of all active vendors against:

• OFAC (US).
• HMT (UK).
• EU consolidated list.
• UN.
• Custom tenant lists (e.g. internal restricted).

A new hit blocks transactions + alerts compliance. False positives can be cleared with reason (audited).

Ownership changes

If a vendor notifies of a change in beneficial ownership (legally required in many jurisdictions), refresh KYC. Watch mechanisms:

• Annual self-declaration requirement.
• Integration with company-register services (where available).

Regulatory updates

When new regulations come into force (new sanctions regime, new licence requirement for a service), compliance flags affected vendors and requests updated documentation.

Incident management

Compliance incidents (audit finding, regulatory breach, customer complaint about vendor misconduct) log as incident records. Investigation, resolution, and follow-up actions tracked.

Holds

A vendor can be placed on hold — all transactions blocked — at compliance discretion:

• Expired critical docs.
• Sanctions hit.
• Open investigation.
• Payment fraud suspicion.

Hold reason recorded; only compliance can lift.

Auditability

Every compliance action has a user, timestamp, and justification. The compliance module produces auditor-ready reports showing controls and their operation.

Reporting

• Expiry dashboard — what's due when.
• Sanctions hit history.
• Hold register.
• Annual compliance pack — for internal / external audit.