Insights

Building resilient partnerships: Prioritizing IT supplier Due Diligence

Verified — Tue, 20 Oct 2026 11:13:05 GMT

Effective Due Diligence for IT suppliers goes beyond a simple checklist in today's rapidly evolving technology landscape. It requires a dynamic and strategic approach to safeguard your business against potential risks and disruptions.

While having a list of tech suppliers is a good starting point, it's crucial to tailor your due diligence efforts based on each vendor's role in your operations and the potential impact of their services.

Key Focus Areas for Due Diligence

Security Alignment

Ensure the supplier's security practices meet your compliance standards and risk appetite. Look for relevant certifications, data hosting compliance, and robust security measures.

Criticality

Evaluate the importance of the supplier's services to your core business functions. Understand the potential impact of a service disruption on your operations and adjust the level of scrutiny accordingly.

Operational Resilience

Assess the supplier's ability to support your up time and recovery objectives. Evaluate their infrastructure, disaster recovery capabilities, and their preparedness for emerging digital risks.

Choosing the right partners

Robust supplier relationships are essential for business resilience. Prioritize vendors who not only meet regulatory standards but actively contribute to your operational success. Seek those who:

Exceed compliance requirements, demonstrating a commitment to security and best practices.
Invest in continuous improvement, staying ahead of evolving technologies and threats.
Proactively address emerging digital risks through training and resource allocation.

Due Diligence: An Ongoing Commitment

Technology and its risks are constantly evolving. Due diligence is not a one-time activity but an ongoing commitment. Regularly reassess your vendors, their services, and their security posture to ensure your business remains adaptable and resilient in the face of an ever-changing digital landscape.

By adopting a proactive and strategic approach to IT supplier Due Diligence, you can protect your business, enhance operational efficiency, and build strong partnerships that contribute to long-term success.

How Accru made AML risk assessment consistent and traceable.

Verified — Tue, 20 Oct 2026 09:51:38 GMT

Accru has a demanding promise: to serve as a full-scale back-office compliance operation for auditing and accounting firms across Sweden, Norway, Denmark, the UK, and France. Compliance isn't a feeling. It's a system. Accru built one.

When Therese joined as Head of Risk and Compliance in September 2024, she arrived with fifteen years as an authorized auditor at KPMG and a stint leading work at FAR, the Swedish industry organization for auditors and accounting consultants. She knew exactly what the industry needed. She also knew it didn't exist yet.

The problem everyone knew but nobody had solved

AML regulation is clear on paper: the general risk assessment, conducted per legal entity, must form the basis for customer-level risk classification. In theory, logical. In practice, the two parts lived in entirely separate places. The general risk assessment sat in a drawer. Customer classification was handled manually and inconsistently, with no system connecting it back to the general risk assessment.

The consequences were predictable: sanctions from supervisory authorities. Auditors and accounting firms struggling to prove why a client was classified as low risk. Assessments that varied depending on who happened to be at the keyboard that day. Therese;

"When I went to market two years ago, we hadn't found a system that came close to matching what we needed.”

A three-party procurement, not two

Therese began by bringing in consultants from NFR Group. A deliberate move: having technical and methodological expertise in the room that wasn't already too close to the problem. Together, they evaluated the market.

"Verified said they could solve this, build something that adapted to our model, rather than asking us to adapt to theirs."

Therese Andersson, Head of Risk and Compliance at Accru

That wasn't a minor detail, it was the entire point. Connecting the general risk assessment to the customer-level workflow is what turns the regulation from a document into something you can actually run a business on.

Working together with NFR Group and Verified, Accru built a model based on twenty parameters. Those parameters are loaded into Verified and configured per agency. The system asks the questions and the staff member answers. The risk classification becomes the output of a consistent, documented model - not a one-off judgment call.

Therese calls it a flagged trail. You go from A to B to C, all the way through. You know where you are, you know what's required, and when you're done, you know you did it right.Therese;

"It gives the person doing the assessment a clear, consistent path to follow"

"Thinking the system is the solution on its own, that would be the wrong conclusion. It's the combination of rigorous work on the underlying assessment, paired with a system that guides you through it."

That's more than an efficiency gain – it's an objectivity gain. Given the same answers from the client, you and I arrive at the same classification, no more, no less. Traceability that holds up under scrutiny. Supervisory authorities had long been skeptical of "low risk" labels they couldn't see the reasoning behind. The four-tier scale, up from three under the old approach, lets Accru show that reasoning.

The pilot: it works

Since February 2026, Accru has rolled out to eight agencies, starting with an initial pilot of five. The feedback is consistent: the flow is smooth, clients understand what's happening and why, and staff feel more confident than before. That confidence is hard to quantify. It's easy to understand. Staff no longer have to second-guess the KYCs they run - did I do it right, did I answer everything, is this enough. That's the difference between hoping nothing slipped through and having a system that helps you show, step by step, that it didn't.

Accru is now extending the rollout beyond these eight agencies. AMLR is incoming, raising the bar further. The methodology, the model, the system, all of it is already in place.

Therese is clear about what it took to get here: time, persistence, the right partners, and a decision not to take the shortcut;

"This is the work that needs to be done. It's not simple, and it's demanding, but it's what's required."

Ræder: One system instead of three vendors

Verified — Tue, 20 Oct 2026 07:06:19 GMT

Ræder, a law firm in Oslo, replaced a patchwork of signing tools and AML checks with one system covering signing, customer registration, and money laundering control.

Ræder chose Verified for one reason: it didn't have to choose between vendors.

"Some deliver a signing solution, some deliver an AML portal. At Verified we got the entire package, in the same system”

- Andrea Mortensen, CFO at Ræder.

Before, document signing at Ræder ran on mail and email, no digital signing solution, no automatic tracking. AML checks meant compiling documentation by hand for every report.

With Verified, documents are signed digitally, tracked automatically, and returned faster. On the administrative side, that means fewer follow-ups chasing signatures, clients submit traceable documentation directly, and the team spends less time closing out paperwork and more time on their actual work.

AML compliance runs the same way: customer registration, KYC checks, ID verification, PEP and sanctions screening, all in one flow, producing one consolidated report instead of a manually assembled one.

Ræder describes the platform as intuitive enough that they built their own tailored user manuals for it, and worked with Verified to configure it specifically for how the firm operates.

How Verified builds for accessibility

Verified — Mon, 19 Oct 2026 15:03:22 GMT

The EU Accessibility Act requires digital platforms to be usable by everyone, including people with visual, hearing, motor, and cognitive impairments. Verified's customers are directly affected by it - so we built accessibility into the product, not bolted on around it.

Making that true took nearly a year of dedicated work across the product and design teams, rethinking not just individual features but the design system underneath them.

"At Verified, accessibility isn't a side project, it's part of how we build. All users should be able to use our customers' services, regardless of ability. That's not just a legal requirement. It's a baseline we hold ourselves to."

- André Bringner, Head of CLM Products, Verified

The first phase focused on the product interface and the PDFs Verified generates - improving clarity, contrast, and readability for users with visual impairments. It's the part of the product every end-user touches directly, which made it the right place to start.

"We didn't just add a few accessibility features and call it done. We spent real time understanding what different needs actually require, and it changed a lot of our assumptions about what 'inclusive design' means in practice,"

- Prakash Khatri Chhetri, Design System Developer at Verified.

Prakash continues;

"We've rebuilt our design principles around accessibility and built a shared design system so the whole team starts from the same place. There's more to do - this isn't something we check off once."

Customers building on Verified's products inherit that work, without needing to solve it themselves.

A bold new brand for a famously unbold industry

Karl Garberg - VP Marketing Verified — Mon, 19 Oct 2026 08:05:34 GMT

Nobody notices compliance until something breaks. Invisible on a good day, front-page news on a bad one. When we do our job well, nothing happens. No fine, no scandal, no name in the paper.

That makes it easy to write off as boring admin. It’s not. Compliance is what stands between clean businesses and the money behind real crime. Behind the scenes, it’s one of the most important jobs out there. It just never gets talked about like one.

And we think that’s a real shame. A job this important deserves more than a grey login screen and Arial. That’s why we’ve rebuilt Verified to match the work: higher ambitions, a clearer purpose and a bolder brand to carry it

So, we’re talking about an industry most people never think about, full of companies that can be hard to tell apart. On paper: the last place a brand should matter.

Why compliance needs a brand

It comes down to how buying actually works. In most B2B industries, only about 5% of potential buyers are in the market at any given moment, and compliance solutions are no exception. Only a small slice of the businesses that need an AML solution are actively looking right now. The rest are heads-down on something else, right up until the day something forces the issue.

And by then, the decision has already been made. Bain and Google found that 80% B2B buyers already have a shortlist in mind before they do any real research, and around nine in ten buy from it. So we can’t wait to be found. We have to be a name people already think of before the need arrives. That’s what a brand is for.

So when we started, we asked ourselves one big question: Can we make anyone care about compliance? Not the people who do it for a living. They already care. But for everyone else.

It started with a strange decision for a compliance company. We wouldn’t build the new Verified brand on the word everyone else in the industry clings to: Trust.

In the Nordics, trust is the default. People assume you are who you say you are. It’s a lovely way to live but a risky way to do business, because trust is usually where things go wrong. So we built on the opposite instinct. Don’t trust. Verify.

A clean record stops being a box you tick to keep the auditor happy. It becomes proof you own, and proof is what keeps good businesses from making bad headlines. Every part of the new brand had to answer that.

The symbol

Look closely and it’s a circle made of verification checks. Each V is a check we run, again and again, wrapped around the data square that the negative space in the middle creates. It isn’t decoration. It’s the product, drawn as a mark. Subtle, but impossible to unsee once you have.

The hallmarks

Hundreds of years ago, goldsmiths began stamping a small mark into silver and gold to prove a piece was the real thing. A hallmark. It meant the item had been checked, and was exactly what it claimed to be. Verification, centuries before anyone called it that. So we built our own visual language out of hallmarks. Shapes that are ours and nobody else’s, so you know it’s Verified before you’ve read the name.

Photography

This is where the brand creates an emotional bond and expresses itself. Real, editorial images, not a stock handshake in sight. They catch the quiet moment just before misplaced trust turns into a problem, and they carry the things we care about: nordic, natural feel together with boldness and curiosity.

The font

Verified Sans. qYou can’t build a differentiated brand and use a Google Font in this day and age. So we drew our own, with G-W Studios and their in-house AI font tool. Tight. Editorial. To the point. No fuss, just scale and spacing doing the work. We want the font to claim its presence and make a statement.

Here’s why we think it’s worth it. In tech, almost everything can be copied. Features get matched in a quarter, and AI writes the same tidy copy for everyone now. When every product clears the bar, the deal comes down to something softer and much harder to copy: whether people believe you, and whether they can stand behind the choice to pick you. That comes from the story you tell and the brand you craft. It’s the one thing a competitor can’t copy.

Compliance data is a sales asset

Verified — Fri, 16 Oct 2026 12:53:36 GMT

Compliance gets filed under cost. It shouldn't be. The information you're already gathering for GDPR, DORA, and ESG can shorten sales cycles and win deals - if it's structured to be reused.

GDPR, DORA, and ESG have pushed most regulated businesses into building detailed information banks about their own operations. That work usually gets treated as overhead: something you produce for a regulator and file away.

But that same data answers most of what a prospect or procurement team asks for in an RFI. A DORA-aligned ICT risk framework, kept current, can answer a large share of a standard RFI directly - no scrambling, no rebuilding answers from scratch each time a deal requires it. That's time your sales team gets back to spend on the customer, not the paperwork.

ESG questions have moved the same way. In many procurement processes, they're no longer optional, they're a shortlist requirement. The reporting you already do for ESG compliance is the same evidence a buyer wants to see before signing. Treated right, it's not a compliance appendix. It's a competitive argument.

None of this works if the data sits in scattered documents. It works when it's structured, searchable, and mapped against the standard question sets buyers actually use - so the same answer can be pulled and reused instead of rewritten every time.

Compliance and sales rarely talk to each other. They should. The data that proves you're audit-ready is the same data that proves to a customer you're a stable, well-run business to work with.

If you're already doing the work to gather this information, the only real question is whether you're using it once - or every time it could help you close a deal.

K.A. Rasmussen: One AML flow, every market

Verified — Fri, 16 Oct 2026 12:40:45 GMT

A self-built system and a separate screening tool, replaced with one flow that covers onboarding, KYC, and PEP and sanctions checks - across every market K.A. Rasmussen operates in.

K.A. Rasmussen, a Norwegian precious metals manufacturer and buyer, has used Verified for signing workflows for several years, starting with HR agreements and other documents needing secure signatures and identification.

About a year ago, that expanded into anti-money laundering work.

"We were heavily involved in driving the project, adapting KYC forms and other processes in the system to fit how we actually work"

- Anita Jørandrud Sveen, HR Manager at K.A. Rasmussen

Before switching to Verified, K.A. Rasmussen ran AML on a self-built system. Updates took time and competed with other development priorities.

"Now we can make most improvements ourselves, directly in the interface. That saves time for whoever's configuring the portal, and it means changes reach the people using it day to day much faster"

- Mette Pedersen, Quality Manager at K.A. Rasmussen.

Before, PEP and sanctions checks ran through a separate service, with the results transferred over manually. Anita Jørandrud Sveen explains;

"Now we can start onboarding, generate KYC forms for signing, identify key individuals, and run PEP and sanctions checks - all in one flow. We can also set the frequency of those checks based on each customer's risk level,"

Mette Pedersen adds;

"We've saved significant time across all our markets. Having everything done and documented in one system gives us a clear, reliable view of the risk across our whole customer portfolio,"
adds Mette Pedersen.

Is Your In-House KYC Solution Holding You Back?

matilda.aistre@gmail.com (Verified test author) — Tue, 08 Sep 2026 10:10:34 GMT

I've spent years helping companies improve their Know Your Customer (KYC) and onboarding. A common problem I see is that systems built in-house often have limitations.

Many companies start by building their own KYC systems because they want the flexibility to customize things. This sounds good initially. But, Anti-Money Laundering (AML) rules are constantly changing, and this quickly reveals the weaknesses of this approach.

AML rules are always being updated, which means KYC processes need frequent adjustments. Compliance and risk teams constantly need changes, which then become IT tasks. The problem? These requests often get in line behind other important development work, creating a bottleneck and stretching resources thin.

This isn't a good situation. It's not efficient from a cost perspective. More importantly, it creates a serious compliance risk. If you're slow to make required regulatory changes, your company is vulnerable.

This is a big challenge, especially for large companies. They need to be in control, but their in-house systems often become an obstacle.

The Solution: Giving Power to Compliance and Risk Teams

Imagine compliance and risk teams being able to directly manage their KYC processes. No more waiting for IT. No more competing priorities.

That's what a no-code KYC platform offers. These systems put the configuration and design tools directly in the hands of the people who understand the needs best: the compliance and risk professionals.

With a simple, no-code interface, these teams can:

Design and customize complete KYC flows: Tailor how customers are onboarded to your exact needs.
Set up risk levels: Define and adjust risk parameters based on your specific risk factors.
Choose and add screening tools: Select the data providers that work best for you.

All of this without any coding or needing IT help.

Benefits of a No-Code KYC Solution:

Lower Costs: Eliminate the ongoing expenses of IT development and upkeep for your KYC system.
More Agile: Quickly respond to regulatory changes and adjust your processes as needed.
Better Compliance: Make sure AML rules are implemented promptly, reducing risk.
Empowered Teams: Give compliance and risk professionals the control they need to manage KYC effectively.
Faster Time-to-Market: Streamline onboarding and bring on new customers more quickly.

If your in-house KYC system is becoming a problem instead of an advantage, it's time to consider a change. Giving your compliance and risk teams a no-code platform can lead to big improvements, from cost savings and better compliance to greater agility and faster growth. Let's connect and talk about how a modern KYC solution can help your business.‍

Tommy Flemström
Co-founder, Verified Global AB

‍tommy.flemstrom@verified.eu‍

UC Enters Strategic Partnership with Verified regarding DORA

Verified — Sun, 17 May 2026 00:45:00 GMT

UC was originally founded by banks with a clear purpose: to streamline and standardize credit decisions. Today, the financial industry faces a new administrative and regulatory challenge through DORA (Digital Operational Resilience Act) and increased requirements for managing third-party risks associated with ICT (Information and Communication Technology) providers.

Against this backdrop, UC is entering a strategic partnership with GRC Watch by Verified. The partnership aims to simplify and standardize operational due diligence and statutory ICT audits for banks and financial institutions.

GRC Watch is a platform that supports banks and other financial actors in operational due diligence and the management of ICT-related third-party risks. By providing a structured and shared process for information gathering, documentation, and vendor monitoring, GRC Watch simplifies statutory audits required by regulations such as DORA.

The platform enables more efficient and uniform vendor assessments by reducing manual tasks and duplicated data collection, while simultaneously strengthening the quality and traceability of risk assessments.

Through this collaboration, UC’s verified corporate information and strong position in the banking world are integrated with GRC Watch by Verified’s platform for operational risk management. Banks will now have access to UC’s verified company profiles directly within GRC Watch, featuring the exact information required to meet DORA requirements - structured, secure, and efficient.

"History is repeating itself. UC was created to bring order and standardization to lending, and now we are making the same journey within DORA and ICT risks. Through our collaboration with GRC Watch by Verified, we are helping the industry move from manual and fragmented processes to a common, efficient standard," says Carl Brynielsson, Interim Managing Director, Sweden at UC AB.

According to estimates, the solution can save between 30 and 60 manual labor hours per completed due diligence process. This reduces both the administrative burden and the risk of non-compliance while strengthening the overall quality of the audits.

The partnership marks a significant step toward a more unified and scalable management of third-party risks in an increasingly complex regulatory environment.

Linda Hellström, Founder of GRC Watch, Compliance Award

Verified — Tue, 23 Sep 2025 04:45:00 GMT

Linda Hellström, founder of GRC Watch, has been named a finalist in the "Compliance person of the year" category at the Compliance Awards, hosted by Credit Management & Compliance Awards.

The nomination recognizes her leadership in the compliance field - work that's helped shape how financial institutions approach regulatory obligations, due diligence, and risk management.

Receiving this recognition is truly an honor and a validation of the work we do every day to simplify and streamline compliance processes.

- Linda Hellström, Founder, GRC Watch

Under her leadership, GRC Watch has built a platform that gives financial institutions a more transparent, automated way to manage compliance, reducing administrative work while strengthening oversight.

GRC Watch is Verified's sister company, sharing a commitment to building safer, more accountable financial systems.

Congratulations, Linda - and good luck in the final round.