Rechecking Our Providers a Year Later

I checked the authorisations of every platform we use when we onboarded. A year later I checked again, expecting a formality. The thing that made it click was reading an exchange licensed under a published digital asset framework alongside.

What had changed

One had been acquired. The entity we contract with was now owned by a different group. The authorisation was intact and the terms had been amended, including the liability section.

We had received an email about the terms change. Nobody had read it.

One had varied its permissions. A permission had been added, which is fine, and a condition had been attached to another, which I did not understand and had to ask about.

One was unchanged.

One had migrated clients to a different contracting entity, in a different jurisdiction, as part of a restructuring. The notification had been in a terms update.

Why the last one matters

The protections attach to the entity holding the authorisation.

We had moved, without doing anything, to contracting with an entity in a place where I had no idea what the client asset rules were. A fintech hits this at a different scale, and a corporate crypto wallet with segregated accounts is what it uses.

That took an afternoon to work out and it ended with us moving the balance.

The check itself

Five minutes each, on the regulator’s own register.

Entity name against the current terms of service. Permissions against what they do for us. Conditions and enforcement history.

The terms check alongside

I now read the amended terms when a change notice arrives, specifically four things: the contracting entity, the liability cap, what happens on insolvency, and whether they may use client assets.

Everything else can wait. Those four determine the position if something goes wrong.

What prompted this

Reading that a platform elsewhere had restructured and moved clients to an entity with weaker protections, and that most clients found out afterwards.

Nobody is obliged to highlight it. It appears in a terms update, which is delivered by email and read by almost nobody.

The habit now

Annually, a calendar reminder. Four platforms, twenty minutes, plus reading any terms changes that arrived during the year.

It found something at three of four in the first year, which was more than I expected from what I had assumed was a formality. Check the country list before planning anything. a support channel with a named contact publishes it and it is shorter than I expected.