Risk Management Policy
How risks are identified, assessed, controlled, escalated, and reviewed across TuriPay.
This policy sets required company standards. A product may be offered only when its applicable controls and provider arrangements are in place. It does not replace product-specific agreements or mandatory legal rights.
Scope and objective
Turi Ventures LLC requires a documented risk-management framework covering financial crime, fraud, settlement, liquidity, third-party dependencies, cybersecurity, privacy, operational resilience, legal obligations, product conduct, and customer harm. Risk decisions must protect customers and the integrity of the platform throughout a product’s lifecycle.
Ownership and oversight
Management must approve risk appetite and assign accountable owners for each material risk. Product and operational teams own day-to-day controls; compliance and security functions provide oversight in their areas; independent review challenges whether controls work. A person must not approve an exception to a control solely because they benefit commercially from that exception.
Assessment and risk register
Before launch and following material change, owners must assess the likelihood and impact of foreseeable risks, the controls in place, residual exposure, and customer consequences. A maintained risk register must record an owner, rating, treatment, review date, and supporting evidence. Country exposure, transaction methods, provider concentration, dependency failures, and foreseeable misuse must form part of the assessment.
Product and provider approval
A product must not become available solely because a technical integration works. Launch requires approved eligibility rules, pricing disclosures, funding and custody responsibilities, settlement and reconciliation arrangements, complaints and dispute handling, data controls, and an exit plan. Providers must receive appropriate due diligence and contractual review. Significant incidents or deteriorating performance require reassessment, restrictions, or suspension.
Financial and settlement controls
Available, pending, reserved, settled, reversed, and disputed amounts must be distinguishable in the records. A provider acknowledgement is not a completed payment. The company requires reconciliation of customer records against relevant provider, bank, or network evidence, with documented investigation of differences. Material unexplained discrepancies must restrict the affected process until assessed. Liquidity and settlement exposure must be monitored without using another customer’s entitlement to cover a shortfall.
Digital asset and fraud exposure
Digital asset controls must address network selection, confirmation, irreversible transfers, issuer or stablecoin failure, depegging, market and conversion risk, sanctions exposure, and provider compromise. Fraud controls must consider account takeover, stolen payment methods, social engineering, refund abuse, and duplicate fulfillment. Limits and review requirements must be proportionate and must not defeat mandatory consumer protections.
Security and operational resilience
Access to sensitive systems must follow least privilege, separation of duties, and stronger authentication for privileged or sensitive actions. Change management, dependency review, protected backups, incident response, and recovery testing must match the service’s risk. Security-sensitive changes and money-movement operations require authorization, traceable records, and validation. Recovery priorities must consider customers whose funds or essential account access are affected.
Incidents and escalation
A suspected loss of customer funds, sanctions breach, data exposure, material fraud, reconciliation failure, or critical outage must be escalated promptly. The incident owner must coordinate containment, evidence preservation, investigation, required notifications, recovery, and customer communications. External reporting obligations must be assessed against applicable law and provider agreements; no universal reporting period is assumed across incident types.
Exceptions, monitoring, and review
Exceptions must identify scope, rationale, risk, approver, compensating controls, and expiry. No exception may authorize illegal activity or waive a mandatory customer right. Management must review indicators such as unresolved reconciliation breaks, overdue investigations, fraud losses, complaints, dispute outcomes, and provider failures. The framework must be reviewed at least annually and after material incidents, with corrective action tracked to closure.
Company and contact
Turi Ventures LLCRegistered in Wyoming, United States30 North Gould StreetSheridan, WY 82801, United Statessupport@turipay.comFor sensitive evidence, request an approved secure channel before sharing documents.
Reference materials
These official resources provide background. Requirements depend on the product, activity, and applicable law.
Management is responsible for assigning policy ownership, maintaining supporting procedures, reviewing these standards at least annually, and updating them when material requirements change.