Can we use our own risk model?

Yes. A starter model is included as a draft for your own compliance review; you change it and a second person approves.

We are an EU financial entity. Does it produce the DORA register?

It builds the Register of Information from your contracts and checks it before export.

RegulaTrust/Third-party risk

Every supplier, checked in proportion to its risk

Know every supplier you depend on, check it in proportion to the risk it brings, and keep the decision on record.

Get early access

A third-party overview: high-risk suppliers, open findings and where suppliers are based

Product screens show fictional firms and example data.

The road every supplier follows

1
Request
One link: the supplier enters its details, owners and documents.
2
Screen
The company, its directors and owners.
3
Rate
Criticality and inherent risk set the depth of due diligence.
4
Approve
A second person signs off; the person who asked never can.
5
Monitor
Re-screening, expiring documents, reviews and renewals on time.

§ 1What it does

01

See your whole supplier base

Every third party, where it is in its lifecycle, and what needs attention.
Filter by stage, criticality, residual risk, category, country and operating company.
Import a supplier list from a spreadsheet, or sync it from your finance system (Oracle Fusion, in pilot).
Duplicates and related suppliers suggested for a person to decide.

A supplier register, from a refinery to a signage company

02

Onboard a supplier with one link

The supplier fills in its own details.

One link carries the company form, the people and owners behind it, and any documents or questions you want from the start.
Nothing reaches the record until someone at your firm accepts it.
Automatic reminders on your schedule; copy the link to send it another way.
A step bar and an “action needed” panel show exactly what is holding a supplier back.

What the supplier sees: its own portal, with only what was asked for

A courier in due diligence: the step bar and what is needed before it can be sent for approval

03

Screen the company and the people behind it

Directors, owners and the company are checked against sanctions, politically exposed person and adverse media lists through your screening provider, and against your own red-flag list.
The provider decides what matched; your firm decides whether each match is genuine, with a reason recorded.
A supplier cannot be activated while any match is undecided; re-screening on a schedule catches a supplier added to a list later.

A possible politically exposed owner, waiting for the firm’s decision

04

Rate the risk, then ask for proportionate evidence

A refinery and a cleaning company are not the same risk.

Criticality is the highest of its dimensions, never an average, and sets the due-diligence level with the inherent risk.
Residual risk is recorded after controls, with a reason when it is lower.
Question modules are chosen by rule: the cleaner is not asked about encryption; the refinery is asked about gold sourcing.
Documents carry expiry dates and are checked by someone other than the person who filed them.

The refinery: high criticality, full due diligence

The cleaner: low criticality, a short set

05

Approve with a second person

Routes by risk: a low-risk supplier needs one approval, a critical one needs senior sign-off as well.
Approve, approve with conditions (which become tracked findings), or reject.
Checks run again at the final approval, so a match found mid-approval still blocks activation.

An approval waiting on a compliance analyst, with the supplier’s risk summarised

06

Track findings to a verified fix

Open, in progress, resolved, closed — closing is a second person’s verification.
Accept a risk instead of fixing it, for a stated period of up to a year, with a second person’s approval.
Serious findings feed your own risk register.

A finding at an armoured cash carrier, with its owner and due date

07

Review, renew and exit cleanly

Periodic reviews start ahead of the date and carry earlier answers forward for confirmation.
Contracts with notice periods; renewals kept as history, with a warning when renewing a supplier whose review is overdue.
Ending a relationship is a checklist and a second person’s sign-off, and records are kept for your retention period from the end of the relationship.
Every step is in the supplier’s history.

Reviews and renewals: two contracts ending soon

A refinery’s history: every step, who took it and when

08

Your ICT register under DORA

For EU financial entities.

The Register of Information is built from the contracts you already record.
A check lists what the supervisor’s validation would reject, before you export; the package exports in the European supervisors’ format.
Concentration: which suppliers and subcontractors several critical functions depend on.

A Register of Information, with what to fix before filing

Concentration: a subcontractor behind several suppliers, and where important suppliers are registered

09

Your methodology, not ours

Factors, weights, bands and review intervals are yours; due-diligence rules can only raise the level, never lower it.
Lifecycle stages, gates and approval routes defined per firm.
Every change is versioned and approved by a second person; old ratings keep the version they were made under.

A vendor risk model, in force once a second person approved it

A vendor workflow: the onboarding stages and the checks before each step

10

For groups

Operating companies: a member assigned to one shop or subsidiary sees only its suppliers.
API keys and signed webhooks connect your own systems.

11

AI assistance, when you want it

Read a supplier’s documents for dates, issuer and issues; pull the clauses that matter from a contract or assurance report; summarise a screening match; draft a due-diligence summary.
Off unless your firm turns it on. Nothing is applied by the model: a person accepts each suggestion.

§ 2Questions

What people ask

Screening runs through your screening provider; RegulaTrust records what matched, who decided, and why.

Compliance Frameworks, controls, risk assessment, policies and incidents.Audit Audits, a tamper-evident audit trail and a public trust page.Pricing Switch on only the parts you use.

Early access

Bring your supplier list and see it rated

We onboard a small number of firms each month, personally.

Or write to hi@regulatrust.com