Policies, versions
and statuses.

Certificate issued by the Portuguese Commercial Registry, showing company name, registered office, corporate purpose, share capital and governing bodies. We provide the access code, which replaces a paper certificate.

Declaration of the company’s beneficial owner, required in virtually every account-opening and institutional onboarding process.

A one-page document with the ownership chain, the appointed management and the company’s signing rules.

Principles of professional conduct applicable to shareholders, management, staff and service providers.

Customer identification and due diligence procedures, risk assessment, record keeping and suspicious transaction reporting.

Documents required from individual and corporate clients, acceptance criteria and verification steps before any work begins.

Rules on gifts, hospitality, facilitation payments, dealings with public entities and conflict declarations.

Criteria for screening international sanctions lists and identifying politically exposed persons during onboarding.

Information classification, access management, authentication, encryption, backups and acceptable use of equipment.

Detection, classification, containment and communication of security incidents, including the 72-hour deadline for notifying personal data breaches.

Selection and assessment criteria for subprocessors with access to client information, and the minimum contractual clauses required.

Identified risks, likelihood, impact, existing controls and an owner for each. Reviewed at least annually.

Disruption scenarios, recovery time objectives, critical dependencies and resumption procedure.

What personal data we process, on what legal basis, for how long, with whom it is shared and how to exercise your rights.

The record required by Article 30 GDPR, listing purposes, categories of data subjects and data, recipients and retention periods.

Clauses for processing data on the client’s behalf under Article 28 GDPR, used in our service agreements.

Retention periods by document type, including statutory tax and anti-money-laundering retention requirements.