Global Compliance Policy

Effective date: February 17, 2026 | Version: 2026.02-global

This Global Compliance Policy defines the cross-functional control framework for legal, privacy, ad quality, security, and financial obligations across VelisAds Network.

Compliance is an operational system, not a one-time checklist; controls must be continuously measured and improved.

Scope and Applicability

Applies to all teams building, operating, and supporting platform services.
Applies to policy governance, control ownership, and release approval workflows.
Applies to third-party onboarding and ongoing supplier oversight.
Applies to audits, regulator responses, and partner due-diligence obligations.
Applies to incident escalation, risk acceptance, and remediation governance.
Applies to all operational regions served by VelisAds Network.

Mandatory Requirements

Governance and Accountability

Each control domain must have named owners and defined escalation paths.
Policies, procedures, and evidence expectations must be documented and versioned.
Exceptions require risk rationale, compensating controls, and expiry dates.
Executive review should cover material risk and remediation progress.

Risk and Control Operations

Risk registers must track findings, impact, owner, and target closure date.
Control testing cadence should match legal and business risk exposure.
Corrective actions require measurable acceptance criteria before closure.
Major incidents must produce root-cause analysis and systemic improvements.

Third-Party and Audit Readiness

Vendors must pass due diligence before handling sensitive workloads.
Contracts must include audit rights, breach duties, and data controls.
Role-based compliance training is mandatory and completion tracked.
Audit evidence must be retrievable, consistent, and time-bound.

Prohibited Practices

Operating high-risk controls without assigned accountable owners.
Approving exceptions without risk analysis or defined expiry.
Suppressing or delaying critical audit findings without justification.
Onboarding vendors without mandatory compliance due diligence.
Falsifying evidence, certification claims, or control status records.
Deploying high-risk features without required cross-functional sign-off.
Ignoring regional legal obligations in active business markets.
Retaliating against good-faith compliance concern reporting.

Governance, Monitoring, and Enforcement

Compliance steering reviews control health, trends, and unresolved risks.
Critical findings are escalated with mandatory remediation deadlines.
Whistleblower and incident channels must support confidential reporting.
Release gates require legal, security, and privacy confirmation for high-risk changes.
Regulatory change tracking must map directly to control updates.
External audit preparation includes completeness and traceability checks.
Recurring violations may trigger feature restrictions or account action.
Policies are reviewed at least annually or after major regulatory change.